It seems like a far more plausible explanation that this is real malware that picked well-known software that people are likely to be downloading from sources that they're not super sure about.