So I have ublock on firefox, so it likely didn’t get past my content blocker?

Sounds like another FLAME repurpose on this malware.