It's a simple little module that will use a lightbox-style effect to darken the user's browser and pop up a new div stating that their session has timed out - and that they need to reauthenticate. It also has the option to provide an image to put in the header of the div, so if you like, you can use the compromised site's logo / favicon to make it feel a touch more authentic. Once the user has provided their user and password again, the page returns to its previous state, and you have their creds.

A potential extension for this module could be to use the collected creds to authenticate to a given login page in order to test the user's credentials before returning them to the site. This will have some other implications if the application doesn't support multiple concurrent sessions, but would provide further authenticity to the user who couldn't just enter in fake creds and be on their merry may.