But the company won't say if it has evidence of malicious exploitation.