Operation Code on Toast is a June 2024 campaign attributed to APT37, also known as ScarCruft, that targeted a specific South Korean organization through a compromised domestic advertising server. Malicious code inserted into content delivered by a toast-ad program exploited a type-confusion flaw in the legacy Internet Explorer JavaScript engine, enabling zero-click remote code execution on affected Windows systems. The chain used a Ruby-based script to deploy ROKRAT, which supported remote commands and theft or transfer of data through cloud-storage services.