Bankash

Dave Evans from Teros pointed out that the PWSteal.Bankash.D trojan includes two lists: one for sites that
have their keystrokes logged and one for sites that don't. The trojan
makes it easy to target VPN services or ecommerce sites. I should think
it would be easy to add the default domain of your ISP as well via a
simple script.

Eventually, one of these trojans will be fairly successful in gathering
passwords for corporate access and the attackers will target
corporations that don't use strong authentication for remote access.
Remember that what they are after is money. They may try to get it by
stealing your HR file for identities that can be stolen, they may try to
get it by blackmailing you - or perhaps both. They don't really care.

You can see the technical details over at Symantec.