This looks similar to a man-in-the-browser attack. The way 2FA is implemented on all the exchanges are not real 2FA it is 1.5FA. As soon as you enter the code into the SAME channel as your UID and PWD you are susceptible to MITB attack or perhaps it is apt to call it man-in-the-wallet attack. The malware waits for you to enter the codes and as soon as you enter a tx the malware does another tx in the background. Have you upgraded your wallets against Heartbeat? That could be another attack vector.
True 2FA is a challenge that you receive on lets say your mobile phone and if you respond with the same out of band channel you have true 2FA. The 2FA app devs must enhance their products to enable response from the mobile back to the backend of the exchange so that you do not need to enter a code into the website itself. This way a number of attacks can be prevented. They can go one step further to install a cert on your phone via their app and this is tied to your exchange account and also display the tx you want to do in the app. This would also cut out a compromise of your email account as an authentication mechanism.