The new threat not only can steal passwords, but can also access additional security features like SMS and authenticator codes