Trojan can be downloaded as a media player, a video quality enhancement program or a download accelerator. When a user surfs the web, the plugin transmits information about the loaded pages to a remote server. In return, it gets a file that enables the Trojan to embed third-party code into pages visited by the user. This is how an apple.com page is displayed on an infected machine. After pressing the ..install the plug-in.. victim is redirected to the site to download malware.
Source: https://thehackernews.com/2013/03/new-mac-os-x-adware-trojan-spreading.html