Trojan horse programs are often designed to steal sensitive information like passwords by appearing legitimate. They can capture keystrokes, read password files, or trick users into entering credentials. The stolen passwords are then transmitted to attackers for unauthorized access.