Loading story…
The Brazilian threat group Prilex evolved from ATM jackpotting into a sophisticated point-of-sale malware operation that targeted Brazil’s payment ecosystem, compromising PoS terminals and EFT/TEF software to steal card data and manipulate EMV transactions. Early campaigns reportedly infected more than 1,000 ATMs at a Brazilian bank and were linked to cash theft and the cloning of more than 28,000 payment cards, while later operations focused on merchant environments by modifying PoS software, intercepting communications between terminals, PIN pads, and banks, and harvesting payment data in real time.
Researchers said Prilex developed techniques that undermined assumptions about the security of chip-and-PIN cards, including the use of a custom Java applet on smart cards to abuse optional EMV transaction steps so terminals could skip card authentication and accept any PIN. More recent variants moved beyond EMV replay to "GHOST transactions," capturing live transaction data and obtaining fresh EMV cryptograms from victim cards for fraudulent purchases. The operation was supported by a broader criminal toolkit that included the Daphne card-writing client, a stolen-card database, backdoor and stealer components, and targeted intrusion methods such as social engineering with fake technicians and remote-access tools like AnyDesk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
According to Securelist, Prilex activity dropped off in 2021 after a highly active 2020. The lull was temporary before the group resurfaced with new variants.
Securelist reports that Prilex was highly active in 2020. This period preceded a quieter phase in 2021 and a later resurgence.
Securelist says Prilex claimed responsibility for a 2019 attack against a German bank. The incident allegedly caused losses of €1.5 million.
Securelist reports that the first Prilex point-of-sale malware samples were observed in the wild in October 2016. These early PoS attacks targeted Brazilian payment software and captured card data from merchant environments.
Securelist says Prilex changed its operational focus from ATM malware to point-of-sale systems in 2016. This marked the group's evolution toward targeting Brazilian payment ecosystems and EFT/TEF software.
During the 2016 carnival period, a Brazilian bank discovered that more than 1,000 of its ATMs had been infected and emptied in a jackpotting attack attributed to Prilex. The intrusion reportedly also enabled cloning of more than 28,000 payment cards used in those ATMs.
Securelist states that the Brazilian threat actor Prilex has been active since 2014. The same source says Brazilian cybercriminals had successfully launched EMV replay attacks since at least that year, techniques Prilex later adopted and evolved.
Securelist states that Prilex resurfaced in 2022 with three new malware variants. The 2022 branch also showed signs that its developers had started using Subversion for version control.
Researchers reported that Prilex had developed a method to steal payment card data from infected PoS terminals and clone EMV chip-and-PIN cards. The operation used modified PoS malware, a malicious Java applet on smart cards, and supporting tools including the Daphne card-writing client and a stolen-card database.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that ATM and point-of-sale malware activity rose sharply in 2018 and remained high in 2019, with detections concentrated in Russia, Brazil, Iran, Vietnam, India, the United States, and several European countries. Russia consistently recorded the highest number of affected devices, underscoring the global scale of attacks targeting payment infrastructure. The report linked the sustained threat to outdated software, unpatched vulnerabilities, weak physical security, and the operational limits of vendor-managed ATM environments. It identified active malware families including **ATMJackpot**, **WinPot**, **Ice5**, **ATMTest**, **Peralta**, **ATMWizX**, **ATMDtrack**, **ATMgot**, **ATMqotX**, and **ATMJaDi**, which support cash-out schemes, card-data theft, and anti-forensic functions, while noting that older malware continues to be reused and that a malware-as-a-service trend is emerging from Latin America.
Aug 14, 2026
Palo Alto Networks disclosed **FindPOS**, a Windows point-of-sale malware family built to steal payment card data from POS systems by scraping process memory for track data and sending the results to attacker-controlled servers over HTTP `POST`. Researchers identified at least nine variants compiled as early as late 2014, showing continued development across versions `2.1` through `6.04`. The malware persists with generated eight-character filenames, `Run` registry keys, and a mutex, and it filters processes by owner before scanning memory to improve the quality of stolen card data. Later FindPOS builds added broader intrusion capabilities, including **keylogging** in version `5.90` and the ability to download additional payloads, indicating operators were extending the malware beyond simple card scraping. Palo Alto also linked related samples to theft of **LogMeIn** credentials, suggesting support for gaining or maintaining access to retail environments. Trustwave’s reference to **Alina**, another POS malware strain, underscores the broader criminal focus on Windows-based payment systems as attackers continued refining malware aimed at harvesting cardholder data from retailers.
Aug 14, 2026
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026