The Sophos seems to imply that this a a browser based attack and that you're infected by only visiting the site.
No, it doesn't. To cite from the site:
Nothing in this article suggests that this is a browser based attack. In contrary, it explicitly says that the script needs to run outside the browser to have the appropriate permissions.
... can't find any practical examples of how this might be achieved