Hackers are tricking people into installing password-stealing malware by making them press keyboard shortcuts under the pretense of proving they're not bots.