Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.