Researchers at security firm Trustwave have uncovered a cache of some two million passwords collected by botnet software called Pony.