Loading story…
Researchers reported that the ModPipe malware targeted Oracle MICROS Restaurant Enterprise Series 3700 point-of-sale systems used in the hospitality sector, with most identified victims in the United States. The modular backdoor persists through Windows services or Run keys, injects into legitimate processes, and communicates with command-and-control servers over HTTP using AES-CBC encryption. Its known components include loaders, a networking module, and plugins such as GetMicInfo, which decrypts MICROS database passwords stored in the Windows registry to access POS databases, configuration data, transaction records, and cardholder names.
Later analysis showed ModPipe had evolved beyond database theft to directly capture payment card data in memory. Kroll observed its JHook module hooking the memcpy function in rsaenh.dll inside the CCS.exe process, allowing attackers to intercept track data during encryption or decryption, while other modules scanned MICROS environments over ports 50123 and 2638 and enumerated running processes. Investigators described ModPipe as an advanced but relatively uncommon POS threat whose modular design enables credential theft, reconnaissance, and card-data collection inside hospitality payment environments.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
Researchers reported in April 2021 that ModPipe used additional modules including JHook, which performs card-scraping by hooking legitimate functions inside POS-related processes.
In April 2020, ESET found three ModPipe downloadable modules in the wild, including GetMicInfo, ModScan, and ProcList, expanding understanding of the malware’s capabilities.
ESET first identified ModPipe’s basic components at the end of 2019 while investigating the modular backdoor targeting Oracle MICROS RES 3700 POS environments.
ESET found seven different ModPipe loader versions with compilation timestamps ranging from approximately December 2017 to June 2020, indicating the malware evolved over several years.
Kroll analyzed a ModPipe sample configured to hook memcpy within rsaenh.dll in the CCS.exe process on a Micros RES POS system and confirmed stolen track data in memory. The firm also noted the malware’s internal buffer appeared to contain roughly twice the number of cards identified in an initial Common Point of Purchase notification.
ESET published analysis of ModPipe as a modular backdoor targeting Oracle MICROS RES 3700 POS systems used in the hospitality sector, with most identified victims in the United States. The report detailed modules used to steal MICROS database credentials, configuration data, and transaction-related information.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
kroll.com
Open sourcewelivesecurity.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **FindPOS**, a Windows point-of-sale malware family built to steal payment card data from POS systems by scraping process memory for track data and sending the results to attacker-controlled servers over HTTP `POST`. Researchers identified at least nine variants compiled as early as late 2014, showing continued development across versions `2.1` through `6.04`. The malware persists with generated eight-character filenames, `Run` registry keys, and a mutex, and it filters processes by owner before scanning memory to improve the quality of stolen card data. Later FindPOS builds added broader intrusion capabilities, including **keylogging** in version `5.90` and the ability to download additional payloads, indicating operators were extending the malware beyond simple card scraping. Palo Alto also linked related samples to theft of **LogMeIn** credentials, suggesting support for gaining or maintaining access to retail environments. Trustwave’s reference to **Alina**, another POS malware strain, underscores the broader criminal focus on Windows-based payment systems as attackers continued refining malware aimed at harvesting cardholder data from retailers.
Aug 14, 2026
Researchers identified **UDPoS**, a point-of-sale malware family that steals payment card data from Windows-based PoS terminals by scraping process memory for **Track 1** and **Track 2** records and exfiltrating the data through fake DNS queries over UDP. The malware disguises itself as legitimate **LogMeIn** or **Intel** update software, installs as a Windows service for persistence, fingerprints infected hosts, and uses structured DNS message types such as `bin`, `info`, `ping`, `trp`, and `note` to send system details and stolen card data to command-and-control infrastructure. The activity reflects the broader evolution of PoS malware from physical skimming to RAM-scraping campaigns that have hit major retail and merchant environments, including malware families such as **Backoff**, **BlackPoS 2.0**, and **GetMyPass**. Researchers said UDPoS appeared to have limited deployment or to be in early development, but its use of DNS for command-and-control and exfiltration gives defenders a clear detection opportunity, particularly in legacy PoS environments where unusual outbound DNS traffic, weak hardening, and poor segmentation can enable card-data theft.
Aug 15, 2026
Visa detailed two 2020 intrusions at North American hospitality merchants in which attackers compromised user and administrator accounts, moved into cardholder data environments, and deployed point-of-sale malware to steal payment card data. In one case, the attackers used phishing, administrative tools, **PowerShell** loaders, and image files with appended shellcode to install **TinyPOS**; in another, they deployed a mix of **RtPOS**, **MMon/Kaptoxa**, and **PwnPOS** after using remote access tools and credential dumpers. The malware scraped **Track 1** and **Track 2** data from process memory, validated card numbers with the **Luhn** algorithm, and stored harvested data in local log files before exfiltration. Separate malware analysis found strong code and workflow overlaps between **TinyPOS** and the **ProLocker** ransomware family, suggesting the same threat actor may have developed and operated both. Researchers identified shared traits including PowerShell-based delivery, image-appended shellcode, similar staging conventions, and a distinctive shellcode decoding mechanism that appeared almost exclusively in samples tied to the two families. Additional similarities, such as six-character partial process-name lists and low-volume campaign patterns, reinforced the assessment that payment-card theft operations and ProLocker ransomware activity were likely connected, although shared infrastructure was not established.
Aug 15, 2026