While it’s currently targeting customers of ING in Poland, the change in behavior has caused concern. The Zeus trojan is now intercepting one-time passcodes to customer accounts.