His browser's built-in security screamed. The file he eventually found was flagged not as a tool, but as a "Trojan" or "Password Stealer."