June 7, 2016 By Douglas Bonderud 2 min read

POS malware remains a huge problem for retailers. Now a new strain — dubbed FastPOS — is changing the credit fraud game by tossing subtle techniques in favor of speedy, smash-and-grab incidents. Here’s a rapid rundown.

Gimme, Gimme, Gimme

Most cybercriminals building or buying POS malware put a high priority on secrecy; the longer their infection goes undetected, the better, since this allows more time to collect and transfer credit card details. To accomplish this aim, POS programs make every effort to obfuscate their location and intent, and only periodically upload stolen credit data to the command-and-control (C&C) server.

FastPOS, meanwhile, takes a different route. According to Softpedia, subtlety is not the malware’s strong point — once it’s up and running, the program grabs as much information as possible and sends it back home.

It starts with a keylogger to grab all keystrokes from any window on affected computers, which transmits relevant data as soon as users press enter. Meanwhile, RAM scrapers with real-time verification features target and take only valid credit card data. Bottom line? This super-speedy stealer isn’t fooling around.

Security firm Trend Micro, which discovered the new strain, said that the malware doesn’t seem to have a particular focus or target industry. But it has appeared across the globe, stealing data at speed and then moving on to the next target.

New Code, New Targets

Also worth noting is a shift in focus. SC Magazine pointed out that FastPOS has avoided complex enterprise networks in favor of smaller, simpler retail systems. It’s not hard to work out the reasoning: The shotgun approach to data theft is quickly noticed by organizations with large IT teams, while smaller companies may not realize what’s going on until it’s too late.

When it comes to infection vectors, FastPOS isn’t straying too far from the beaten path. Common methods include a real-time file sharing service, compromised medical websites and the occasional brute-force VNC connection. Researchers have also discovered several online forums selling the stolen data.

One in particular not only hosts an ad for the malicious code, but also resolves to the same IP as one of the malware’s C&C servers. That suggests that whoever is operating the forum also developed the malware, effectively creating a one-stop shop for both credit details and the means to obtain this data.

POS tools are evolving to meet market demand. Enterprises getting wise to point-of-sale malware tricks? Small businesses are next in line. Criminals not getting enough credit card data to satisfy demand? They opt for speed over subtlety, taking whatever they can and getting out.

It’s not sophisticated or elegant, but it’s worrisome. Speed benefits the bad guys, and right now FastPOS is one step ahead.

More from

Bypassing Windows Defender Application Control with Loki C2

10 min read - Windows Defender Application Control (WDAC) is a security solution that restricts execution to trusted software. Since it is classified as a security boundary, Microsoft offers bug bounty payouts for qualifying bypasses, making it an active and competitive field of research.Typical outcomes of a WDAC bypass bug bounty submission:Bypass is fixed; possible bounty awardedBypass is not fixed but instead "mitigated" by being added to the WDAC recommended block list. Likely no bounty awarded but honorable mention is typically givenBypass is not…

FYSA — VMware Critical Vulnerabilities Patched

< 1 min read - SummaryBroadcom has released a security bulletin, VMSA-2025-0004, addressing and remediating three vulnerabilities that, if exploited, could lead to system compromise. Products affected include vCenter Server, vRealize Operations Manager, and vCloud Director.Threat TopographyThreat Type: Critical VulnerabilitiesIndustry: VirtualizationGeolocation: GlobalOverviewX-Force Incident Command is monitoring activity surrounding Broadcom’s Security Bulletin (VMSA-2025-0004) for three potentially critical vulnerabilities in VMware products. These vulnerabilities, identified as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, have reportedly been exploited in attacks. X-Force has not been able to validate those claims. The vulnerabilities…

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today