A team of researchers from Ruhr University in Bochum, Germany, has created a new kind of cyber attack where malicious code is able to be sent in parallel with a legitimate software download without modifying any code. The new attack binds the malware to free and open source software, because there are fewer code signing and integrity checks in place for such downloads. It’s unusual in the fact that the code isn’t injected into the software, but rather bound to it. The researchers explain what that means: “Since the original application is not modified one has the advantage that the malicious code can be of a larger size, and thus provide more functionality. Then, upon starting the infected application the binder is started. It parses its own file for additional embedded executable files, reconstructs and executes them, optionally invisible for the user.”