The malware was executed on a compromised system, allowing attackers to harvest credentials of bank clerks and administrators. This activity was detected following a successful phishing attempt, which is pivotal for attackers to gain further access to critical financial systems.