Yes the attacker is on the move again right now. He donated some ether into the DAO and joined both whitehat splits. We drained the ETH he donated as fast as we could but he got what he wanted.
An attacker in now part of split 78 and he can now do the split attack again in that white hat DAOs. This is why we need a soft fork. I will publish a blog post very soon with the steps forward from now on.
But DO NOT panic. That means that any other move the attacker would try to do would come after 24 days. And that gives us more than enough time to have the soft fork implemented.
https://np.reddit.com/r/ethereum/comments/4p9z93/it_seems_attacker_just_targeted_the_whitehatdaos/d4j7ldn