In plain sight: Credential and data stealing adware