Security News > 2020 > October > Visa Warns of Attack Involving Mix of POS Malware

A North American merchant's point-of-sale terminals were infected with a mix of POS malware earlier this year, Visa reports.

In May and June 2020, the company analyzed malware variants used in independent attacks on two North American merchants, one of which employed a TinyPOS variant, while the other involved a mix of malware families such as MMon, PwnPOS, and RtPOS. As part of the first attack, phishing emails were sent to a North American hospitality merchant's employees to compromise user accounts, including an administrator account, and legitimate administrative tools were used to access the cardholder data environment within the network.

In addition to harvesting card data and preparing it for exfiltration, the malware can enumerate processes running on the system to identify those pertaining to specific POS software.

"The malware utilized in these stages of the compromise was not recovered. The POS malware variants used in this attack targeted track 1 and track 2 payment account data," Visa explains in a technical report.

MMon, also referred to as on underground forums, has been around for roughly a decade, and so far powered POS scraping malware such as JavalinPOS, BlackPOS, POSRAM, and more.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/x9X3cPBIx5I/visa-warns-attack-involving-mix-pos-malware