Lurking "spyware" may be a security weak spot