The attackers have learned from their mistakes and have now developed a more aggressive version of the worm. It has already stolen over 27,000 credentials.