February 20, 2014 By Dana Tamir < 1 min read

Maintaining the security of point-of-sale (POS) systems is a growing concern. The trend of POS malwares discovered last year continues with the recently discovered JackPOS malware. Like a number of POS malware families discovered last year, including Dexter, vSkimmer, Alina and BlackPOS, the new JackPOS malware is designed to steal payment card information from the infected POS systems. Similar to these malwares, it utilizes a command-and-control (C&C) communication channel to receive operational commands and exfiltrate the stolen credit card data.

The loading and delivery of the JackPOS malware is done through a drive-by download attack. After infecting the systems, the malware extracts credit card data from point-of-sale systems using code similar to the RAM-scraping POS malware known as Alina. The attackers use obfuscated compiled AutoIt script, which, according to IntelCrawler, “became quite a popular method to avoid AV detection in order to unpack additional binary malicious code and execute further instructions received from the C&C server.”

Take a proactive response to today’s advanced persistent threats! Read the white paper to learn how

More from Malware

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

8 min read - IBM X-Force uncovered a new phishing campaign likely conducted by Hive0117 delivering the fileless malware DarkWatchman, directed at individuals associated with major energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. DarkWatchman malware is capable of keylogging, collecting system information, and deploying secondary payloads. Imitating official correspondence from the Russian government in phishing emails aligns with previous Hive0117 campaigns delivering DarkWatchman malware, and shows a possible significant effort to induce a sense of urgency as…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today