The malicious code could sign owners up to subscription services without permission.