I realize my story sounds rediculous but it is what it is.

After the dropbox shutdown and the ddos issues a lot of mirrors were created on different sites I am trying to find out if any of these links still exist and if they could have also been infected.
That moment of chaos would have been a perfect time to circulate a client without people noticing it.