According to RSA, the malware has been logging credit card data from infected systems since October 2013.