Hard-to-detect credential-theft malware has infected 1,200 and is still going