Persistence Through Service Workers—Part 1: Introduction…

This blog post demonstrates how an attacker can deploy browser service workers (using the Shadow Workers project) to persist in users' browsers, intercept and modify in-scope requests/responses, and proxy actions using victims' sessions; it walks through registering a domain, provisioning a DigitalOcean/WordPress target with HTTPS, and notes important limitations such as the need for file write access on the webserver and proper TLS.