Comment by fredsted

Maybe the hackers found their API keys in the app binary.