The revamped Nukebot banking trojan has shifted from stealing bankcard data to quietly downloading malicious payloads for web-injects, cryptocurrency mining, and taking screenshots of systems.