it's not the app that it's malicious, it's the website

It's both, according to another comment.