I remember reading on the Tor project blog that the malware was based on a reverse engineered security patch. The browser bundle was afterward changed to aggressively prompt the user to update when a new version is out in order to prevent a similar scenario.