Hackers use flaw in popular file transfer tool to steal data, researchers say