Step-by-step: How Shell was hijacked in ad hoax