Loading story…
Researchers identified UDPoS, a point-of-sale malware family that steals payment card data from Windows-based PoS terminals by scraping process memory for Track 1 and Track 2 records and exfiltrating the data through fake DNS queries over UDP. The malware disguises itself as legitimate LogMeIn or Intel update software, installs as a Windows service for persistence, fingerprints infected hosts, and uses structured DNS message types such as bin, info, ping, trp, and note to send system details and stolen card data to command-and-control infrastructure.
The activity reflects the broader evolution of PoS malware from physical skimming to RAM-scraping campaigns that have hit major retail and merchant environments, including malware families such as Backoff, BlackPoS 2.0, and GetMyPass. Researchers said UDPoS appeared to have limited deployment or to be in early development, but its use of DNS for command-and-control and exfiltration gives defenders a clear detection opportunity, particularly in legacy PoS environments where unusual outbound DNS traffic, weak hardening, and poor segmentation can enable card-data theft.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Forcepoint reports that the LogMeIn-themed UDPoS files, including logmeinumon.exe and LogmeinServicePack_5.115.22.001.exe, shared a compilation timestamp. This provides an explicit anchor for the malware build observed by researchers.
Trend Micro identifies GetMyPass as a new PoS malware family that emerged around the holiday shopping weekend. The malware used a configuration file and appeared to be a multicomponent design similar to an earlier BlackPoS variant.
Trend Micro says BlackPoS version 2.0 appears to have been used in the massive data breach targeting Home Depot. It also notes the malware cloned the exfiltration technique of the BlackPoS variant involved in the Target breach.
Trend Micro reports that US-CERT discovered the Backoff point-of-sale malware, a successor to Alina/Track that scraped card data from memory and gathered system information. The article places this discovery within the 2014 wave of PoS malware incidents.
Trend Micro states that the BlackPoS variant whose exfiltration technique was later cloned by BlackPoS 2.0 was involved in the Target breach. The reference anchors this as part of the 2014 PoS malware landscape.
Forcepoint published analysis of a newly identified point-of-sale malware family dubbed UDPoS, which used DNS over UDP for command-and-control and exfiltration of stolen payment card data. Researchers said it was unclear whether the malware was actively used in the wild at the time of writing.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers analyzed a modified **Neutrino** malware strain, tracked as `Trojan-Banker.Win32.NeutrinoPOS`, that targets point-of-sale environments and steals payment card data directly from system memory. The malware delays execution, extracts a Base64-encoded list of command-and-control servers from its body, and checks for active infrastructure through a POST-based handshake using encoded markers including `enter` and `success` before sending stolen data. Beyond card theft, the sample includes broad backdoor functionality that allows operators to download and run files, capture screenshots, search for processes, modify the registry, steal files, and use infected hosts as proxies. Its payment-card theft routine scans process memory for **Track 1** and **Track 2** data, validates primary account numbers with the **Luhn algorithm**, and exfiltrates harvested records to its controllers; observed infections were concentrated in **Russia** and **Kazakhstan**, with nearly 10% of affected systems belonging to small-business corporate customers.
Aug 14, 2026
Palo Alto Networks disclosed **FindPOS**, a Windows point-of-sale malware family built to steal payment card data from POS systems by scraping process memory for track data and sending the results to attacker-controlled servers over HTTP `POST`. Researchers identified at least nine variants compiled as early as late 2014, showing continued development across versions `2.1` through `6.04`. The malware persists with generated eight-character filenames, `Run` registry keys, and a mutex, and it filters processes by owner before scanning memory to improve the quality of stolen card data. Later FindPOS builds added broader intrusion capabilities, including **keylogging** in version `5.90` and the ability to download additional payloads, indicating operators were extending the malware beyond simple card scraping. Palo Alto also linked related samples to theft of **LogMeIn** credentials, suggesting support for gaining or maintaining access to retail environments. Trustwave’s reference to **Alina**, another POS malware strain, underscores the broader criminal focus on Windows-based payment systems as attackers continued refining malware aimed at harvesting cardholder data from retailers.
Aug 14, 2026
Researchers found a previously dormant command-and-control server tied to **Flokibot** distributing a new point-of-sale malware family dubbed **LockPoS**, which targeted PoS environments in Brazil and was designed to steal payment card data from memory. The malware uses a multi-stage loader chain that extracts embedded resources, decrypts them with **AES-256-CBC**, decompresses payloads, injects code into `explorer.exe`, and then loads the final LockPoS DLL. LockPoS persists through a Windows Registry **Run** key, stores its initial configuration and C2 address in a resource, and communicates with its server over HTTP using structured data chunks. Researchers said the malware supports configuration updates, download-and-execute, self-update, and process injection, while its main function is scraping card track data and exfiltrating it to infrastructure associated with the host `treasurehunter[.]at`, linking the operation to earlier Flokibot activity and underscoring the continued risk PoS malware poses to retail, restaurant, and hotel organizations.
Aug 15, 2026