Using two malware variants, unknown operators managed to compile stolen card data potentially worth more than $3 million, researchers said.