In April, a new breed of bank robber hit 24 U.S. and Canadian banks, scooping up $4 million in less than two weeks before heading to Europe and stripping millions more from 17 Polish banks and one major Portuguese bank. From all reports, the bandit is just getting warmed up, with hundreds more banks on the list.

But this crook is code. Dubbed GozNym by security experts, it’s the progeny of Gozi and Nymaim, two forms of malware each considered powerful and dangerous standing alone. In GozNym, they have spawned an efficient predator that feeds on financial institutions by attacking them through their weakest and most lucrative vulnerability—commercial banking customers.