A major malware operation has stolen vast numbers of passwords, according to security company researchers.