Sometimes it's a key-logger but sometimes it brings up a fake "re-login" screen.