A new browser-based malware exploits trusted domains like Google to bypass antivirus defenses, posing a threat to online payments.