The Trojan is capable of compromising user accounts even if they’re using two-factor authentication.