Malicious software has been stealing credit card details from thousands of online stores, say researchers.