Defending Against Credential Worms