A Trojan has been identified as having stolen details from around 500,000 online bank accounts and credit and debit cards.