Researchers say the attack was likely part of a wider operation to steal cryptocurrency and login credentials by tricking users through a fake Google verification check to trick victims.