Threat actors are spreading password-stealing malware disguised as a security tool to target Ukraine's IT Army.