Maintaining the security of point-of-sale (POS) systems is a growing concern. The trend of POS malwares discovered last year continues with the recently discovered JackPOS malware. Like a number of POS malware families discovered last year, including Dexter, vSkimmer, Alina and BlackPOS, the new JackPOS malware is designed to steal payment card information from the infected POS systems. Similar to these malwares, it utilizes a command-and-control (C&C) communication channel to receive operational commands and exfiltrate the stolen credit card data.

The loading and delivery of the JackPOS malware is done through a drive-by download attack. After infecting the systems, the malware extracts credit card data from point-of-sale systems using code similar to the RAM-scraping POS malware known as Alina. The attackers use obfuscated compiled AutoIt script, which, according to IntelCrawler, “became quite a popular method to avoid AV detection in order to unpack additional binary malicious code and execute further instructions received from the C&C server.”

Take a proactive response to today’s advanced persistent threats! Read the white paper to learn how

more from Malware

From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers

A comparative analysis performed by IBM Security X-Force uncovered evidence that suggests Bumblebee malware, which first appeared in the wild last year, was likely developed directly from source code associated with the Ramnit banking trojan. This newly discovered connection is particularly interesting as campaign activity has so far linked Bumblebee to affiliates of the threat group ITG23 (aka the Trickbot/Conti…

Unprecedented Shift: The Trickbot Group is Systematically Attacking Ukraine

Following ongoing research our team, IBM Security X-Force has uncovered evidence indicating that the Russia-based cybercriminal syndicate "Trickbot group" has been systematically attacking Ukraine since the Russian invasion — an unprecedented shift as the group had not previously targeted Ukraine. Between mid-April and mid-June of 2022 the Trickbot group, tracked by X-Force as ITG23 and also known as Wizard Spider,…

World’s Largest Darknet Market Shut Down, $25 Million in Bitcoin Seized

On April 5, German authorities announced the takedown of the Hydra marketplace, the world’s largest darknet market trading in illicit drugs, cyberattack tools, forged documents and stolen data. The criminal operation, with about 17 million customer accounts, raked in billions in bitcoin before getting shut down. On its website, the Federal Criminal Police Office (BKA) stated it had secured and…