My first guess when I read the title was some sort of compromised tool or browser downloaded first to give access. Yep, right on target.