Yes, malware can steal passwords. One of the uses of Trojan horses and phishing emails is to steal your usernames and passwords. Keylogger malware also tracks keystrokes, so if you type in a password, it can access it.