File infector Expiro hits US, steals FTP credentials