The Trojan has once again branched out beyond its roots as banking malware and is now targeting the master passwords guarding major password management products. A new configuration file found on an infected computer targeting processes used by the respective password management tools. 

Citadel, like most widely distributed malware families, is crossing over more and more from the realm of cybercrime to APT-style targeted attacks. New features and a hunger for legitimate credentials make the malware, which is already sitting on hundreds of thousands of machines, particularly dangerous to critical infrastructure, in addition to financial services.