Android malware steals money from PayPal accounts while users watch helpless

Android trojan waits for users to enter PayPal credentials and two-factor security code before triggering money transfers.