Teams from Sana Security have discovered a difficult-to-detect trojan designed to steal passwords previously used on infected machines.