This was stealing the seed phrases as they were being displayed so the user could make the paper backup you suggest and in the process have all their current and future coins stolen.