I was fantasizing about doing something like this.... I guess someone beat me to it.... though these people could have done this more professionally.

They could have launched it like FTC and CNC, and pump and dump the new coin as if it were real, while the trojaned client does the stealing. If the user encrypted the wallet, chances are that that's the same passphrase to all their other wallets. Give the new coin a real blockchain, and encode the captured passphrases and perhaps even the wallets in the transaction the user broadcast. The client could patch all the other cryptocurrency clients found on the system so when the user authorises a transaction in any of these clients, it will always be encoded to the same address for the full amount in the wallet, no matter how much and what address the user specified. That way, there will be no need for passphrase logging and wallet capture in the other clients, and the damage continues even after the new coin's cover has been blown.