Yeah, so Labryinth qt windows wallet - confirmed was sniffing for passphrases on many QT based wallets with a memory scanning block. They opened the console on open wallets, sent commands, and then closed the console in a total of 19ms..... Less than 1 frame at 60hz. (way faster than most monitors wake from sleep).
The wallet was left running as overrun memory code that injected itself into windows textinput.exe/ctfmon.exe