They were running an old official version which has a serious issue allowing the full node servers it connects to to pop up a message. e.g. "You need to upgrade - click here" - that led to the malware.