Malware attackers have used fake Electrum wallet updates to scam users out of more than $22 million in bitcoin.