Category Archives: point of sale

FIN8 tries to breach U.S. hotel with new malware variant, researchers say

Posted on by

A well-known criminal hacking group tried to breach the computer network of a U.S. hotel using a variant of malware the group had last deployed in 2017, according to research from endpoint security firm Morphisec. FIN8, as the financially-driven group is known, made several upgrades to its ShellTea malware, aiming it at the network of the hotel between March and May, according to Morphisec. Researchers believe it was an attempted attack on a point-of-sale POS) system, or one that processes payment card data. The intrustion attempt was blocked. In a blog post published Monday, Morphisec warned of the vulnerability of POS networks to groups like FIN8. “Many POS networks are running on the POS version of Window 7, making them more susceptible to vulnerabilities,” wrote Morphisec CTO Michael Gorelik. “The techniques implemented can easily evade standard POS defenses.” The research did not identify the hotel by name or specificy its location, […]

The post FIN8 tries to breach U.S. hotel with new malware variant, researchers say appeared first on CyberScoop.

Continue reading FIN8 tries to breach U.S. hotel with new malware variant, researchers say→

Payment scammers hit 201 campus checkouts with Magecart-inspired tactics

Posted on by

A gang of payment-card scammers has targeted 201 college and university campus stores, trying to steal students’ financial data in a Magecart-style attack, according to new research. The new cybercrime group, labeled Mirrorthief, injected malicious code on payment checkout pages at hundreds of U.S. and Canadian stores, according to TrendMicro research published Friday. By compromising PrismWeb, an e-commerce platform designed for college stores, the attackers could collect payment card details, names, addresses and phone numbers, researchers said. PrismWeb is made by PrismRBS, a subsidiary of the Nebraska Book Company. TendMicro’s report comes as security researchers continue to grapple with an expansion of payment-card thievery along with an apparent surge in demand for stolen financial information. Success by one group inspires imitators in another. The most prominent, Magecart, is a collection of perhaps 12 hacking campaigns that steal payment information by secretly collecting data from online checkout pages. TrendMicro researchers noted that Mirrorthief is […]

The post Payment scammers hit 201 campus checkouts with Magecart-inspired tactics appeared first on CyberScoop.

Continue reading Payment scammers hit 201 campus checkouts with Magecart-inspired tactics→

Magecart is the most infamous payment skimmer. But it’s hardly the only one.

Posted on by

There’s been a steady stream of news about malware designed to skim customer payment data during e-commerce transactions, but research by security vendor Group-IB suggests that the problem is broader than the public might realize. JavaScript-sniffers — JS-sniffers for short — were lurking on 2,440 hacked websites that receive roughly 1.5 million unique daily visitors, according to research published Wednesday by the Moscow-based company. The malicious software essentially produces the same results as a credit card skimmer: Cybercriminals inject a few lines of code onto target websites, then sweep up account numbers, names, addresses and other information that’s valuable on dark web markets. And it’s not just Magecart, the best known group of JS-sniffers, Group-IB says. Twelve Magecart groups have been in operation, but Group-IB says its researchers discovered a total of 38 JS-sniffer groups — at least eight of which have not previously been investigated in detail. One JS-sniffer campaign, known as TokenLogin, was detected on sites that […]

The post Magecart is the most infamous payment skimmer. But it’s hardly the only one. appeared first on CyberScoop.

Continue reading Magecart is the most infamous payment skimmer. But it’s hardly the only one.→

Hide it well or market it well: Two reports show how point-of-sale malware has users in mind

Posted on by

Sometimes the little things can help cybercriminals separate their wares from the pack. It could be an uncommon feature in the malware itself, or it could just be a new way to market a familiar strategy. In unrelated reports Wednesday, cybersecurity companies detailed DMSniff, which takes a new approach to remaining stealthy as it steals point-of-sale (POS) information from consumers, as well as GlitchPOS, which steals credit-card information in a familiar way but comes with an instructional video from its creators. Threat intelligence company Flashpoint reports that DMSniff has quietly been in active use since 2016 thanks in part to a domain generation algorithm, which allows hackers to continue siphoning data from a web page even after police or researchers have taken hackers’ domain pages offline. Flashpoint notes that the use of such an algorithm is “rarely seen” in the smash-and-grab world of POS malware, where thieves typically distribute malware to as many sites as possible and […]

The post Hide it well or market it well: Two reports show how point-of-sale malware has users in mind appeared first on CyberScoop.

Continue reading Hide it well or market it well: Two reports show how point-of-sale malware has users in mind→

Caribou Coffee reports data breach including payment information at 265 stores

Posted on by

American coffee seller Caribou Coffee recently suffered a breach exposing customer payment data at 265 U.S. stores for roughly three months, according to a notice posted to the company’s website. The retailer says an outsider had unauthorized access to point-of-sale systems at affected locations between Aug. 28 and and Dec. 3, someone had unauthorized access to its point of sale systems at affected stores. Hackers may have accessed customer names, payment card numbers, expiration dates and security codes. The company says payments made through its rewards program were not affected. Caribou says that it detected “unusual activity” on its network on Nov. 28, which prompted it to hire Mandiant, a cybersecurity incident response company owned by FireEye. Mandiant identified the issue within two days, the notice says, although customers may have been affected through Dec. 3. Caribou says it’s working to beef up its network security and its payment system in order to better protect customer information. […]

The post Caribou Coffee reports data breach including payment information at 265 stores appeared first on CyberScoop.

Continue reading Caribou Coffee reports data breach including payment information at 265 stores→