April 15, 2015 By Jaikumar Vijayan 3 min read

Security researchers at Trend Micro have identified a sophisticated new point of sale (POS) malware family being used to steal credit and debit card data from POS systems in Brazil and, to a lesser extent, the United States and other countries.

Prolific Theft

In a single month, the one-man operation behind the campaign has used the malware to steal data from more than 22,000 payment cards. The malware family, dubbed FighterPOS by Trend Micro, is currently being sold to other cybercriminals as a top-ranking POS malware tool in Brazil.

Trend Micro described FighterPOS as a full-featured piece of malware designed specifically to exfiltrate data from POS systems. The malware supports strong encryption and has multiple ways of communicating with its command-and-control systems.

One-Man Operation

The author of the malware tool appears to be an individual who has considerable experience in payment scams, malware creation and selling stolen credit and debit cards. Available evidence suggests the individual is acting independently and doesn’t have any accomplices in running the campaign, Trend Micro noted.

At around $5,250, FighterPOS is not particularly cheap for a malicious tool in its class, especially since it isn’t technically new. However, what sets it apart from other malware is its well-designed control panel and wide variety of features for carrying out attacks against POS systems.

Familiar Functionality

Functionally, FighterPOS does many of the same things other POS malware tools do. It is designed to collect Track 1 and Track 2 data as well as card verification value codes from credit and debit cards swiped through infected POS systems. This data is all that is required to clone a payment card and use it for fraudulent purposes.

The malware also incorporates a memory-scraping function and a keylogging capability that lets attackers capture everything that is typed in on an infected POS system. The control panel itself is an enhanced version of a popular botnet client called vnLoader that lets attackers remotely control infected POS systems.

Some of the components used in FighterPOS, such as its memory-scraping component, are very similar to components in older malware tools. The malware shows how cybercriminals are becoming increasingly proficient in developing their own tools using code from older products and other components readily available in the cyber underground.

“As more cybercriminals gain the ability to build their own POS malware variants, we will see more of them sold underground and used in attacks,” the firm cautioned.

Its research shows that about 96 percent of the infected POS systems are located in Brazil, slightly less than 2 percent are in the U.S. and the remaining handful are in Mexico, the United Kingdom and Italy.

POS Malware Attacks

Payment card data breaches stemming from attacks on POS systems have been a growing concern, especially in the U.S., which is one of a handful of developed nations that still uses magnetic stripe credit and debit cards. Most countries long ago moved to payment systems based on the Europay MasterCard Visa (EMV) smartcard standard. EMV cards use microchips instead of magnetic stripes to store cardholder data. Payment systems in many countries require cardholders to also use a personal identification number (PIN) when using these cards.

Such chip-and-PIN cards are considered much harder to clone and use fraudulently than signature-based magnetic stripe cards, especially for card-present transactions at POS systems. While it might be possible for an attacker to steal Track 1 and Track 2 data from an EMV card using malware such as FighterPOS, it is very hard to clone a card with that data in the same way it is possible with magnetic stripe cards. The U.S. payment network is currently in the process of migrating to EMV smartcard technology.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today