According to Blizzard the malware is able to operate

Original: If you WoTLK Classic Gold didn't make it to BlizzCon 2017. we got you covered! We've teamed with Blizzard to give away 10 (10) BlizzCon Goody Bags. What's included:

Blizzard Tainment has advised World of Warcraft players to be on the lookout for an "dangerous Trojan" that can be able to steal information from accounts even when you're using an authenticator to provide protection, the company posted on its forums late last night.

According to Blizzard the malware is able to operate in real-time and steals information from your World of Warcraft account information as well as the authenticator's password when you both. Blizzard advises users with compromised accounts try to identify the Trojan by following the instructions below.

"It is identified by creating an MSInfo files and then scanning the Startup Program section of that file for either Disker  buy WOW WoTLK Classic Gold or Disker64.' It will usually appear as follows:

Blizzard announced that it is currently studying the malware it discovered however, so far, they have discovered no anti-virus programs that will remove it , other than reformatting your system. To help Blizzard in finding a solution you can post a comment on the ongoing support thread by writing the following: