Security researchers at GData security firm discovered a second stage of the cyber attack on German Bundestag that exploited a banking trojan to steal data.