So, the malware managed to also steal OTP token too. But to make any kind of transfer, doesn’t the bank need a new OTP token entirely? This description suggest

So, the malware managed to also steal OTP token too. But to make any kind of transfer, doesn’t the bank need a new OTP token entirely? This description suggests that the malware ejects itself after collecting OTP & Credentials, but by the time the miscreants tries to initiate a transfer, I expect the OTP to have expired. Only issue left is, people not using OTP and/or disabled OTP for online transactions, but that should be not possible in 2023!