The crimeware recorded the keystrokes of legitimate TSP users, stealing personal identification numbers and other account information.
Two dozen TSP members were victimised, losing a total of about US$35,000, according to a TSP statement.
TSP officials notified the US Secret Service of the hackings.
The TSP made clear in a statement that the crimeware was installed on member computers, and the TSP network has not been breached.
The Federal Retirement Thrift Investment Board, which administers the TSP, urged all users to install or update PCs with anti-virus, firewall and anti-spyware software.