Re: @DCFusor - Then they tell their friends, and they tell THEIR friends and...
The attack vector isn't. The code it installs is.
There are mitigations for the attack vector but you should address OS protections against malware assuming that credentials have been compromised.