First seen in 2014, the malware can steal passwords and install remotely controlled programs via emails disguised as return messages.