A previously undocumented .NET trojan and its companion Pheno plugin allow attackers to capture mobile authentication codes ...