Loading story…
A global intrusion campaign targeted point-of-sale thin clients, including VMware Horizon deployments, and delivered multi-stage malware that ended with Cobalt Strike beacons and FrameworkPOS on compromised systems. Researchers said the activity affected organizations in the United States, Japan, and India across finance, insurance, and healthcare-related sectors, using PowerShell, WMI, and HTA/VBScript staging to load shellcode in memory and establish persistence. Investigators observed a scheduled task named WindowsHelpAssistant, a Registry Run key, and rundll32.exe loading Assistant32.dll, with related artifacts including btid.dat and external connections from likely patient-zero hosts.
The tradecraft overlaps with earlier FIN6 operations tied to large-scale payment-card theft and prior FrameworkPOS intrusions, though researchers said attribution remains unconfirmed. Historical reporting linked FIN6 to spam- and credential-theft-based initial access, lateral movement inside victim networks, and deployment of FrameworkPOS/Trinity to harvest card data from retail and hospitality environments. In the newer campaign, stolen payment data was reportedly XOR-encoded with 0xAA and exfiltrated through DNS tunneling, while multiple active command-and-control servers used a consistent URL and communications pattern.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
After retro-hunting identified multiple servers delivering the same Cobalt Strike beacon and command-and-control pattern, Morphisec said it notified customers and legal authorities about currently active C2 infrastructure.
Morphisec said the campaign shared indicators with FIN6, including use of WMI, PowerShell, FrameworkPOS, lateral movement, and privilege escalation, while also noting some ties to EmpireMonkey. The company said it lacked sufficient data for definitive attribution.
Morphisec reported a high number of prevention events on February 6 that blocked execution of a Cobalt Strike backdoor as part of a broader campaign targeting point-of-sale thin clients.
Red Canary incident responders investigated a FrameworkPOS intrusion in which encoded PowerShell launched via services.exe downloaded installer_8.exe, established persistence through a Run key and Scheduled Task, and used rundll32.exe to load assistant32.dll via the workerInstance export. Investigators identified likely lateral movement and a patient-zero host whose external connection was consistent with the campaign previously described by Morphisec.
In a 2016 report, FireEye attributed an ongoing PoS intrusion campaign to FIN6 and tied the group to more than 20 million stolen credit or bank cards, with one documented incident involving 20 million records and a deployment to 2,000 systems.
FireEye said the FIN6 campaign began in 2014 and targeted point-of-sale environments in hospitality and retail organizations, using spam-delivered malware and credential theft to gain access.
Over an 8-10 week period, Morphisec tracked attacks against point-of-sale thin clients, including VMware Horizon systems, in the United States, Japan, India, and other locations. The multi-stage infections used PowerShell, WMI, and HTA/VBScript staging, then deployed Cobalt Strike beacons and in some cases the FrameworkPOS scraper.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 87 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
blog.morphisec.com
Open sourceredcanary.com
Open sourcethreatpost.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
Visa detailed two 2020 intrusions at North American hospitality merchants in which attackers compromised user and administrator accounts, moved into cardholder data environments, and deployed point-of-sale malware to steal payment card data. In one case, the attackers used phishing, administrative tools, **PowerShell** loaders, and image files with appended shellcode to install **TinyPOS**; in another, they deployed a mix of **RtPOS**, **MMon/Kaptoxa**, and **PwnPOS** after using remote access tools and credential dumpers. The malware scraped **Track 1** and **Track 2** data from process memory, validated card numbers with the **Luhn** algorithm, and stored harvested data in local log files before exfiltration. Separate malware analysis found strong code and workflow overlaps between **TinyPOS** and the **ProLocker** ransomware family, suggesting the same threat actor may have developed and operated both. Researchers identified shared traits including PowerShell-based delivery, image-appended shellcode, similar staging conventions, and a distinctive shellcode decoding mechanism that appeared almost exclusively in samples tied to the two families. Additional similarities, such as six-character partial process-name lists and low-volume campaign patterns, reinforced the assessment that payment-card theft operations and ProLocker ransomware activity were likely connected, although shared infrastructure was not established.
Aug 15, 2026