Monday, November 4, 2024
HomeComputer SecurityVISA Warning that Hackers Injecting POS Malware in Fuel Dispenser Merchants...

VISA Warning that Hackers Injecting POS Malware in Fuel Dispenser Merchants To Steal Payment Card Data

Published on

Malware protection

Visa Payment Fraud Disruption (PFD) observed that hackers attack point-of-sale merchants by injecting POS malware across North American fuel dispenser merchants to steal the cardholder data.

Sophisticated hackers groups breach the internal network of the POS Merchants to infect the network with POS malware, which is completely different from skimming at fuel pumps.

In a November report, VISA confirmed that malware threat actors were able to breach the network and steal the payment card data due to the lack of secure acceptance technology.

- Advertisement - SIEM as a Service

“Targeted Fuel dispenser merchants are very slow to deploy the Chip technology in their station which attracts threat actors attempting to compromise POS systems for magnetic stripe payment card data.” visa said.

With the evidence collected in the forensic report, Researchers believe that the attackers who involved in this attack attributed to the FIN8 cybercrime group.

GBHackers previously reported FIN8 group activities, and the groups are a financially motivated threat group active since at least 2016 and often targets the POS environments of the retail, restaurant, and hospitality merchants to harvest payment account data.

Different Incidents were observed

At the First incident, Visa investigation reveals that the attackers successfully compromised the merchant’s network through a phishing email that contained a malicious attachment.

Once the Victims open the attachment, installed a Remote Access Trojan (RAT) on the merchant network, and granted the threat actors network access which helps attackers to perform the reconnaissance the corporate network to utilize the credentials and move further into Victims POS environment.

Visa recently observed the second incident that targets another North American fuel dispenser merchant where the attackers gained the network access, but it was unclear how they gained initial access.

According to the VISA report, A RAM scraper was injected into the POS environment and was used to harvest payment card data. The targeted merchant accepted both chip transactions at the in-store terminals and magnetic stripe transactions at fuel pumps, and the malware injected into the POS environment appears to have targeted the mag stripe/track data specifically.

The third incident was targeted to the North American hospitality merchant where the attackers used FIN8-attributed malware and another new malware is a full-featured shellcode backdoor that is based on the RM3 variant of the Ursnif, a banking trojan.

With malware, no evidence indicating that it targets the fuel dispenser merchants, but the attacker will use it for future Merchants attacks.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals...

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215...

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a...

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy...

Russian Hackers Attacking Ukraine Military With Malware Via Telegram

Researchers discovered a Russian-linked threat actor, UNC5812, utilizing a Telegram persona named "Civil Defense....