The tool, which steals user data, also deletes a warning email from Google notifying the user of a suspicious login.