I'm getting a number of questions about this right now. The only fact we have right now is that the PhoenixMiner account on the download site Mega has been disabled. That could be for any reason.

Other than that it's difficult to get confirmed information on what happened here. Someone (Nicehash team claiming it's the Phoenix Miner developer, but I don't know if that is confirmed) posted another download link to Phoenix Miner that contained different files.

There are two possibilities here:

1) It was the actual PhoenixMiner developer that posted the link and the new mining software could contain some virus

2) Someone pretending to be the PhoenixMiner developer and posted a link to the new mining software that for sure contains virus. Maybe they even tricked the Nicehash team into including it in their software?

I can also point out that I receive e-mail messages every month where someone ask me to include "Gminer 3.0", "Phoenix Miner 6.1" or "Claymore Miner 20.0" or similar, where they provide a link to the download. I never click on any of those as it's obvious what they are trying to do here.