Beware of 'BlackPOS' malware in data breaches

On Sept. 15, a U.S. judge certified a class action suit against Target, which several banks brought against the corporation in the wake of its massive 2013 data breach. (See the Sept. 15 Reuters article by Joseph Ax.) Retailers like Target, Home Depot and Albertsons, among many others, are still paying for deficient security systems that allowed the "BlackPOS" malware (also known as "RAM Scraper" or "Kaptoxa") to infiltrate "point of sale" (POS) card swipe machines at cash registers and steal personally identifiable information (PII).

Hackers and cybercriminals are still developing variants of this devious malware, partly to circumvent EMV or chip cards. (Fraud Magazine will cover EMV technology in a future issue. Also see What CFEs should know about the U.S.'s approaching smart card transition, by Zach Capers, CFE, The Fraud Examiner. – ed.)

BlackPOS disguises itself as an installed service of a known anti-virus vendor software to avoid being detected and, consequently, deleted in the infected POS system.