Instead of spreading malware, hackers hide text-based instructions inside web pages or documents.