Yep, using webpages via https would be compromised. The bots hook various DLL to get the content before encryption when it's sent and after decryption when it's received.<p>They don't seem to use keylogging. They only capture HTML form information.