Loading story…
Researchers reported that the Dexter point-of-sale malware family continued stealing payment-card data through multiple active campaigns, with newer variants extending earlier tooling documented in malware samples and packet captures. Analysis of 2012 samples showed Dexter scraping payment data, injecting into iexplore.exe, establishing persistence through the Windows Run registry key, and contacting command-and-control infrastructure including http://193.107.17.126/test/gateway.php and several domains using /portal1/gateway.php. Shared artifacts such as U:\FirmWork\Studio\Common\Bin.exe and @@PAUH linked related samples, while infrastructure records pointed to hosting registered through Seychelles but believed to be operating from Russia.
By 2014, Arbor Networks ASERT found Dexter still prevalent alongside Project Hook, with the Dexter Revelation variant using fake .zip and .txt files, FTP-based exfiltration, memory scraping, and keylogging to harvest card data from compromised terminals. ASERT traced Revelation development to April 2013 and associated activity with a suspected actor using the handle "Rome0", while also observing that Project Hook and Alina backend panels remained online in early-year monitoring. The findings showed that public exposure after major retail breaches had not disrupted the operators, and that defenders still faced active POS malware infrastructure and evolving theft techniques.
Get the actors, campaigns, and ATT&CK mapping behind it.
11 events from the most recent confirmed update back to the earliest known activity.
On the same day as Arbor’s report, Target announced an overhaul of its information security processes, said CIO Beth Jacob had resigned, and said it would seek an external hire for the CIO role while creating a chief compliance officer position.
Arbor Networks’ ASERT reported that attackers were still actively using the Dexter and Project Hook point-of-sale malware families in 2014, based on analysis of exfiltrated data dumps and network activity.
Arbor Networks ASERT said newer research traced developmental versions of the Dexter Revelation variant back to April 2013, indicating the malware family continued evolving after the earlier Dexter disclosures.
A malware-analysis post documented three additional tester-type Dexter point-of-sale malware samples alongside previously known ones, detailing shared artifacts, persistence, process injection, and command-and-control infrastructure including 193.107.17.126/test/gateway.php.
ASERT published a list of IP addresses and hostnames associated with Dexter command-and-control activity and said some servers were still active, urging organizations to review logs and indicators for compromise.
ASERT said it suspected a threat actor using the handle "Rome0" or "rome0" was directly involved with Dexter, citing observed familiarity with banking Trojans and participation in carding forums.
Sally Beauty Supply confirmed that someone attempted to breach its systems, though it did not confirm whether customer data was at risk.
Krebs on Security reported that 282,000 stolen credit card numbers appeared on an underground market, and three banks investigating the batch found the purchased cards had all been used at Sally Beauty Supply stores within the previous 10 days.
The article states that Target suffered a major breach in November in which attackers stole more than 40 million credit and debit card records and 70 million other customer records from point-of-sale systems.
Researchers found a special URL hosting backend panels for the Project Hook and Alina point-of-sale malware families during January and early February, showing those operations were still active.
ASERT had previously identified three Dexter variants in December: Revelation, Stardust, and Millennium. This marked a further classification of the Dexter malware family beyond the earlier sample reporting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **FindPOS**, a Windows point-of-sale malware family built to steal payment card data from POS systems by scraping process memory for track data and sending the results to attacker-controlled servers over HTTP `POST`. Researchers identified at least nine variants compiled as early as late 2014, showing continued development across versions `2.1` through `6.04`. The malware persists with generated eight-character filenames, `Run` registry keys, and a mutex, and it filters processes by owner before scanning memory to improve the quality of stolen card data. Later FindPOS builds added broader intrusion capabilities, including **keylogging** in version `5.90` and the ability to download additional payloads, indicating operators were extending the malware beyond simple card scraping. Palo Alto also linked related samples to theft of **LogMeIn** credentials, suggesting support for gaining or maintaining access to retail environments. Trustwave’s reference to **Alina**, another POS malware strain, underscores the broader criminal focus on Windows-based payment systems as attackers continued refining malware aimed at harvesting cardholder data from retailers.
Aug 14, 2026
Proofpoint disclosed a new point-of-sale malware family, **AbaddonPOS**, that steals payment card data by scraping track information from process memory on infected systems. The malware establishes persistence, uses basic obfuscation and process blacklisting to hinder analysis, and exfiltrates stolen card data to hardcoded command-and-control servers over a custom binary protocol. Researchers observed AbaddonPOS delivered through multi-stage infection chains involving **Vawtrak** and **TinyLoader**, with distribution tied to the **Angler exploit kit**, **Bedep**, and weaponized Microsoft Office documents. Proofpoint reported strong code-level similarities between TinyLoader and AbaddonPOS, indicating they are likely closely related and may have been developed by the same threat actor, while later findings also pointed to earlier variants and infrastructure overlaps with malware including **Fleercivet/Bagsu** and **ReactorBot/Rovnix**.
Aug 14, 2026
Researchers found a previously dormant command-and-control server tied to **Flokibot** distributing a new point-of-sale malware family dubbed **LockPoS**, which targeted PoS environments in Brazil and was designed to steal payment card data from memory. The malware uses a multi-stage loader chain that extracts embedded resources, decrypts them with **AES-256-CBC**, decompresses payloads, injects code into `explorer.exe`, and then loads the final LockPoS DLL. LockPoS persists through a Windows Registry **Run** key, stores its initial configuration and C2 address in a resource, and communicates with its server over HTTP using structured data chunks. Researchers said the malware supports configuration updates, download-and-execute, self-update, and process injection, while its main function is scraping card track data and exfiltrating it to infrastructure associated with the host `treasurehunter[.]at`, linking the operation to earlier Flokibot activity and underscoring the continued risk PoS malware poses to retail, restaurant, and hotel organizations.
Aug 15, 2026