Security has long been a major concern when it comes to mobile banking and mobile payments users, and now, there’s one more reason to be concerned.

Discovered by ESET researchers out of Slovakia, the new malware can compromise login credentials and put users at risk.

It’s a new kind of Trojan malware, the ESET researchers noted, and it provides users with a fake login screen when opening a mobile banking app.

Users enter credentials as normal, but then the credentials are transferred to the cybercriminals who placed the malware, allowing for remote transfers from most anywhere.

Even two-factor authentication isn’t sufficient protection here, as it’s believed the malware can provide access to text messages as well. The malware goes so far as to request device administrator rights, making it extremely difficult to remove from devices.

So far, the malware is targeting institutions throughout three different countries: Turkey, Australia and New Zealand. A total of 20 institutions so far have been struck, and it may not be too difficult to route to new banks in other countries.

The concerns about security have always been valid concerns, though effort to protect against such matters has generally been robust. After all, even two-factor authentication pales in comparison to biometric security, and we’re rapidly working to make that a standard.

That’s going to make this malware largely useless, because how would it manage to simulate a thumb print or voice print or the like? It does, however, underscore the greatest point about any security: it must evolve.

That which one can do, another can undo, and that makes security a constant struggle. Keeping up with the latest will be vital to protecting a mobile payments system or anything else, and that which does the job today may not tomorrow.

This latest bit of malware proves the necessity of improving security, even when it seems like it’s already top-notch. After all, security that protects today is good….but security that protects tomorrow is even better.