FastPOS is a variant of POS malware discovered by Trend Micro researchers. The new POS malware foregrounds on how speed the credit card data is stolen and sent back to the hackers.
Contents
History
Researchers at Trend Micro have named the new malware variant as TSPY_FASTPOS.SMZTDA. The malware is used by hackers to target small and mid-sized businesses (SMBs) in many countries like France, Taiwan, Japan, Brazil, Hong Kong and United States.
Operation
Unlike other POS malware, FastPOS does not store the information locally to send it to the cyber thieves periodically. The variant POS malware executes the attack on the target through infected websites or through Virtual Network Computing (VNC) or via file sharing service. The stolen data is instantly transferred to the Control and Command Server that is hardcoded by the hacker. The POS malware consists of two components– a keylogger and a RAM scraper. The logged keystrokes are stored in memory and transmitted to the attacker when the Enter key is pressed and are not stored in a file of the infected system. The stolen data can be user credentials, payment information which depends on the business procedures. The RAM scraper is devised to steal only credit card data. The memory scraper is designed to verify the service code of the credit card to help remove out cards that demands PINS.