A malware that swaps a victim's copied crypto wallet address with an attacker's is being included with Microsoft Office extension packages on SourceForge.