Flash exploit distributes credential-stealing malware