The Trojan program, dubbed "OddJob," appears to be a work in progress, but is already different from many malware in at least two respects, according to Amit Klein, chief technology officer at security firm Trusteer, which discovered it.

Unlike other conventional hacking tools, OddJob does not require fraudsters to log into a user's online bank account to steal from it. Instead, the malware is designed to hijack a user's online banking session in real-time by stealing session ID tokens.

These are tokens issued by a bank to identify a user's online bank session. By stealing the tokens and embedding them into their own browsers, fraudsters can impersonate a legitimate user and access accounts while the user is is still active online. The access allows fraudsters to then conduct whatever banking operations the account holder can perform.

"The malware essentially allows the fraudster to share the session with the victim so that any activity the victim can see, the fraudster can see as well," Klein said.

The approach is different than typical man-in-the browser attacks where attackers use Trojans to steal login credentials that are then used to break into online accounts.