Two separate campaigns have been stealing credentials and browsing history for months.