"Even though a prompt like this is not a novel approach to stealing credentials and other information ??? what struck us the most was the amount of URL triggers\" that cause Sinowal to actually launch this prompt and other functions: Sinowal is triggered by more than 2,700 specific URLs, which means that this Trojan quickly moves into action when users access the websites of what are now hundreds o" . . . .