You know what the solution to this is? Replace your damn equipment all at the same time :). Just make sure to implement some good hygiene pretty quickly.

Attackers would have to go through the entire process of phishing you again to be able to do any rootkit level stuff again.