plugin malware attack