Malicious hackers are already targeting a new flaw in a popular file-transfer tool