I initially thought the same thing (although never had any malware I knew of on any of my Macs ever) so I tried entering false passwords which came back as failed log-ins. It was only after entering the correct one later did it verify and the application finally launched so unless they had a way to authenticate actual Apple ID accounts as well, highly unlikely to be malware.