New investigations into the CCleaner incident point to a possible third stage that had keylogger capacities