Sounds like a classic case of malware.