[gildas]

It's not necessarily a JavaScript malware. A pure HTML page with a <form> tag could suffice to steal credentials.