1. A computer-implemented method for detecting data-stealing malware the method comprising: detecting an attempt by an untrusted application to access a storage location on a computing device that is known to be used by a legitimate application when storing potentially sensitive information; determining that the legitimate application is not installed on the computing device by determining that a registry key known to be associated with the legitimate application is not present on the computing device; determining that the untrusted application represents a potential security risk; performing a security operation on the untrusted application to protect the computing device from the untrusted application; wherein the method is performed by at least one processor of the computing device.