Even software downloaded from official sources can have PUPs. That's why it's a good idea to read the End User License ...

Malware hidden inside a fake NFT game ignores two-factor authentication and gains access to a victim's Google account via a malicious Chrome Extension to steal your money.