The second interesting feature in OddJob is its ability to keep an online banking session open and live even after users think they have logged out of their account. This allows criminals to extract money and continue other fraudulent activity even after the user thinks the session has ended.

"The fraudster has a keen interest in the session not being terminated. So in order to avoid that, the malware has the ability to detect logout attempts and to discard them," he said. The users will likely not notice the failed logout, or will assume the bank server is sluggish and shut their browser down without realizing that their sessions are still active.

Trusteer first came across OddJob last year during a fraud investigation for a bank. The company has been unable to openly talk about it until now because of investigations by law enforcement agencies, Klein said.

OddJob presently is programmed to steal session ID tokens from customers of dozens of specific banks in the U.S., Poland and Denmark. When customers log into their accounts using Microsoft's Internet Explorer or Mozilla's Firefox, OddJob grabs their session ID token and sends it in real-time to the Command-and-Control server where the session can be hijacked.

According to Trusteer, an analysis of OddJob's configuration data shows that it can be programmed to execute other actions on targeted Web site besides stealing session information. The code can grab full pages of data, terminate connections and inject malicious code into sites.