Zaufana Trzecia Strona , a local Polish news site , first reported the attacks late Friday , last week . The news site said that during the past week , the security teams at several , yet unnamed , Polish banks detected downloads of suspicious files and encrypted traffic going to uncommon IPs situated in many foreign countries . As employees at different banks started looking into their systems , they found malware installed on numerous workstations and even some servers . The JavaScript code worked by opening a hidden iframe and forcibly downloading a file on the victim 's computers . Users that discovered and executed this file would install a remote access trojan ( RAT ) on their computers . According to Zaufana Trzecia Strona , this malware has a zero detection rate on VirusTotal and appears to be a new malware strain , never-before-seen in live attacks . KNF 's staff have cleaned their site and along with the affected banks , have reported the incidents to CERT.pl . The affected Polish banks said the malware that infected their computers and servers encrypted its outgoing traffic and they were n't able to tell what the attackers stole Attack.Databreach . Banks reassured their clients and said they have n't detected any unauthorized transactions , but only the mysterious outgoing traffic . Local media believes the attack is the work of a foreign intelligence agency . A more believable theory would be that this is the work of one of the many cyber-crime syndicates specialized in cyber-thefts Attack.Databreach from financial institutions . The attacks have the signs of classic network reconnaissance operations , where hackers gather intelligence in order to create a map of a victim 's network before launching their final assaults