Because the malware presented a fake authentication prompt under the pretense of "installing additional codecs" which allows it to escalate privilege.