A new wave of "living off the land" malware—which employs small scripts in legitimate files—is quietly stealing user credentials.