The malware spoofs entire websites, while keeping the address bar intact.