Researchers discovered a remote code execution vulnerability and cybercriminals are using its reputation to deliver malware.