Windows attack can steal your logged-in username and password