Security researchers have found malicious code hiding behind a website that claimed to show an up-to-date global heatmap of Coronavirus reports.