A malicious iPhone worm targeting online customers of ING in the Netherlands has been identified by security outfit F-Secure.
The worm only targets jailbroken iPhones which have SSH (secure shell) remote access installed and have not changed the default password.
It redirects the bank's customers to a fake site with a log-in screen connected to a Web-based command and control centre in Lithuania. The worm can then behave like a botnet, enabling the phone to be accessed or controlled remotely without the permission of its owner.
F-Secure says the new worm is not widespread, but it is much more serious than the recently discovered first iPhone worm, Ikee, as it seems to try to steal information from the devices.
Mikko Hypponen, research director, F-Secure, told the BBC that, although only a few hundred handsets are thought to be infected so far, the worm could jump from phone to phone among owners using the same wi-fi hotspot.
An ING spokesperson told the BBC that a a warning would be put on the bank's official Web site and call centre staff briefed on the potential security threat.