So the first thing I did was to search the source code to see which banks had been targeted and for my surprize – one of the Bulgarian banks was targeted – ProCredit. The link to the e-banking login page thou is invalid, but the name of the password field is correct 🙂

Stay tuned for more info.