June 7, 2016 By Douglas Bonderud 2 min read

POS malware remains a huge problem for retailers. Now a new strain — dubbed FastPOS — is changing the credit fraud game by tossing subtle techniques in favor of speedy, smash-and-grab incidents. Here’s a rapid rundown.

Gimme, Gimme, Gimme

Most cybercriminals building or buying POS malware put a high priority on secrecy; the longer their infection goes undetected, the better, since this allows more time to collect and transfer credit card details. To accomplish this aim, POS programs make every effort to obfuscate their location and intent, and only periodically upload stolen credit data to the command-and-control (C&C) server.

FastPOS, meanwhile, takes a different route. According to Softpedia, subtlety is not the malware’s strong point — once it’s up and running, the program grabs as much information as possible and sends it back home.

It starts with a keylogger to grab all keystrokes from any window on affected computers, which transmits relevant data as soon as users press enter. Meanwhile, RAM scrapers with real-time verification features target and take only valid credit card data. Bottom line? This super-speedy stealer isn’t fooling around.

Security firm Trend Micro, which discovered the new strain, said that the malware doesn’t seem to have a particular focus or target industry. But it has appeared across the globe, stealing data at speed and then moving on to the next target.

New Code, New Targets

Also worth noting is a shift in focus. SC Magazine pointed out that FastPOS has avoided complex enterprise networks in favor of smaller, simpler retail systems. It’s not hard to work out the reasoning: The shotgun approach to data theft is quickly noticed by organizations with large IT teams, while smaller companies may not realize what’s going on until it’s too late.

When it comes to infection vectors, FastPOS isn’t straying too far from the beaten path. Common methods include a real-time file sharing service, compromised medical websites and the occasional brute-force VNC connection. Researchers have also discovered several online forums selling the stolen data.

One in particular not only hosts an ad for the malicious code, but also resolves to the same IP as one of the malware’s C&C servers. That suggests that whoever is operating the forum also developed the malware, effectively creating a one-stop shop for both credit details and the means to obtain this data.

POS tools are evolving to meet market demand. Enterprises getting wise to point-of-sale malware tricks? Small businesses are next in line. Criminals not getting enough credit card data to satisfy demand? They opt for speed over subtlety, taking whatever they can and getting out.

It’s not sophisticated or elegant, but it’s worrisome. Speed benefits the bad guys, and right now FastPOS is one step ahead.

More from

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

How red teaming helps safeguard the infrastructure behind AI models

4 min read - Artificial intelligence (AI) is now squarely on the frontlines of information security. However, as is often the case when the pace of technological innovation is very rapid, security often ends up being a secondary consideration. This is increasingly evident from the ad-hoc nature of many implementations, where organizations lack a clear strategy for responsible AI use.Attack surfaces aren’t just expanding due to risks and vulnerabilities in AI models themselves but also in the underlying infrastructure that supports them. Many foundation…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today