June 7, 2016 By Douglas Bonderud 2 min read

POS malware remains a huge problem for retailers. Now a new strain — dubbed FastPOS — is changing the credit fraud game by tossing subtle techniques in favor of speedy, smash-and-grab incidents. Here’s a rapid rundown.

Gimme, Gimme, Gimme

Most cybercriminals building or buying POS malware put a high priority on secrecy; the longer their infection goes undetected, the better, since this allows more time to collect and transfer credit card details. To accomplish this aim, POS programs make every effort to obfuscate their location and intent, and only periodically upload stolen credit data to the command-and-control (C&C) server.

FastPOS, meanwhile, takes a different route. According to Softpedia, subtlety is not the malware’s strong point — once it’s up and running, the program grabs as much information as possible and sends it back home.

It starts with a keylogger to grab all keystrokes from any window on affected computers, which transmits relevant data as soon as users press enter. Meanwhile, RAM scrapers with real-time verification features target and take only valid credit card data. Bottom line? This super-speedy stealer isn’t fooling around.

Security firm Trend Micro, which discovered the new strain, said that the malware doesn’t seem to have a particular focus or target industry. But it has appeared across the globe, stealing data at speed and then moving on to the next target.

New Code, New Targets

Also worth noting is a shift in focus. SC Magazine pointed out that FastPOS has avoided complex enterprise networks in favor of smaller, simpler retail systems. It’s not hard to work out the reasoning: The shotgun approach to data theft is quickly noticed by organizations with large IT teams, while smaller companies may not realize what’s going on until it’s too late.

When it comes to infection vectors, FastPOS isn’t straying too far from the beaten path. Common methods include a real-time file sharing service, compromised medical websites and the occasional brute-force VNC connection. Researchers have also discovered several online forums selling the stolen data.

One in particular not only hosts an ad for the malicious code, but also resolves to the same IP as one of the malware’s C&C servers. That suggests that whoever is operating the forum also developed the malware, effectively creating a one-stop shop for both credit details and the means to obtain this data.

POS tools are evolving to meet market demand. Enterprises getting wise to point-of-sale malware tricks? Small businesses are next in line. Criminals not getting enough credit card data to satisfy demand? They opt for speed over subtlety, taking whatever they can and getting out.

It’s not sophisticated or elegant, but it’s worrisome. Speed benefits the bad guys, and right now FastPOS is one step ahead.

More from

How prepared are you for your first Gen AI disruption?

5 min read - Generative artificial intelligence (Gen AI) and its use by businesses to enhance operations and profits are the focus of innovation in virtually every sector and industry. Gartner predicts that global spending on AI software will surge from $124 billion in 2022 to $297 billion by 2027. Businesses are upskilling their teams and hiring costly experts to implement new use cases, new ways to leverage data and new ways to use open-source tooling and resources. What they have failed to look…

Cybersecurity crisis communication: What to do

4 min read - Cybersecurity experts tell organizations that the question is not if they will become the target of a cyberattack but when. Often, the focus of response preparedness is on the technical aspects — how to stop the breach from continuing, recovering data and getting the business back online. While these tasks are critical, many organizations overlook a key part of response preparedness: crisis communication.Because a brand’s reputation often takes a significant hit, a cyberattack can significantly affect the company’s future success…

Brands are changing cybersecurity strategies due to AI threats

3 min read -  Over the past 18 months, AI has changed how we do many things in our work and professional lives — from helping us write emails to affecting how we approach cybersecurity. A recent Voice of SecOps 2024 study found that AI was a huge reason for many shifts in cybersecurity over the past 12 months. Interestingly, AI was both the cause of new issues as well as quickly becoming a common solution for those very same challenges.The study was conducted…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today