Webhards are the main platforms that the attackers targeting Korean users exploit to distribute malware. What was recently found was XMRig, famous Monero Miner.
Anyway - if you do not download software from the official site, but from random sources, do not be surprised you get promo "2 in 1".
More info:
https://asec.ahnlab.com/en/37526/