A new variation of the notorious banking trojan has been found lurking in the wild, bent on targeting software-as-a-service (SaaS) applications.