Malicious script logs passwords and just about anything else admins or visitors type.