That is why we always recommend everyone to not Trust, but Verify.

If a user would compare the Checksum of the compromised download, they would have found something fishy real quick.

Someone did comfirmed loss of coins on Twitter due to this incident.