Security researchers at Trend Micro have identified a sophisticated new point of sale (POS) malware family being used to steal credit and debit card data from POS systems in Brazil and, to a lesser extent, the United States and other countries.

Prolific Theft

In a single month, the one-man operation behind the campaign has used the malware to steal data from more than 22,000 payment cards. The malware family, dubbed FighterPOS by Trend Micro, is currently being sold to other cybercriminals as a top-ranking POS malware tool in Brazil.

Trend Micro described FighterPOS as a full-featured piece of malware designed specifically to exfiltrate data from POS systems. The malware supports strong encryption and has multiple ways of communicating with its command-and-control systems.

One-Man Operation

The author of the malware tool appears to be an individual who has considerable experience in payment scams, malware creation and selling stolen credit and debit cards. Available evidence suggests the individual is acting independently and doesn’t have any accomplices in running the campaign, Trend Micro noted.

At around $5,250, FighterPOS is not particularly cheap for a malicious tool in its class, especially since it isn’t technically new. However, what sets it apart from other malware is its well-designed control panel and wide variety of features for carrying out attacks against POS systems.

Familiar Functionality

Functionally, FighterPOS does many of the same things other POS malware tools do. It is designed to collect Track 1 and Track 2 data as well as card verification value codes from credit and debit cards swiped through infected POS systems. This data is all that is required to clone a payment card and use it for fraudulent purposes.

The malware also incorporates a memory-scraping function and a keylogging capability that lets attackers capture everything that is typed in on an infected POS system. The control panel itself is an enhanced version of a popular botnet client called vnLoader that lets attackers remotely control infected POS systems.

Some of the components used in FighterPOS, such as its memory-scraping component, are very similar to components in older malware tools. The malware shows how cybercriminals are becoming increasingly proficient in developing their own tools using code from older products and other components readily available in the cyber underground.

“As more cybercriminals gain the ability to build their own POS malware variants, we will see more of them sold underground and used in attacks,” the firm cautioned.

Its research shows that about 96 percent of the infected POS systems are located in Brazil, slightly less than 2 percent are in the U.S. and the remaining handful are in Mexico, the United Kingdom and Italy.

POS Malware Attacks

Payment card data breaches stemming from attacks on POS systems have been a growing concern, especially in the U.S., which is one of a handful of developed nations that still uses magnetic stripe credit and debit cards. Most countries long ago moved to payment systems based on the Europay MasterCard Visa (EMV) smartcard standard. EMV cards use microchips instead of magnetic stripes to store cardholder data. Payment systems in many countries require cardholders to also use a personal identification number (PIN) when using these cards.

Such chip-and-PIN cards are considered much harder to clone and use fraudulently than signature-based magnetic stripe cards, especially for card-present transactions at POS systems. While it might be possible for an attacker to steal Track 1 and Track 2 data from an EMV card using malware such as FighterPOS, it is very hard to clone a card with that data in the same way it is possible with magnetic stripe cards. The U.S. payment network is currently in the process of migrating to EMV smartcard technology.