The bug was being used by scammers in an effort to try to steal banking logins, researchers say.