malware disguised as tools