Loading malware…
FindPOS is a Windows point-of-sale malware family first observed in variants dating to 2014 and developed across multiple versions. It is designed primarily to steal payment card data from Microsoft Windows-based POS environments by enumerating processes, reading process memory, and extracting track data that matches payment-card patterns. Later variants added stronger validation of scraped card data, including checks on expiration dates and service codes, indicating iterative refinement for payment-card theft operations.
The malware installs itself persistently by copying itself under generated host-specific names and creating autorun entries so the implanted copy launches automatically. It also uses a mutex to enforce a single running instance and can remove the original executable after installation. During operation, it enumerates running processes, identifies process ownership, and selectively scrapes memory from targeted processes. Stolen data is periodically exfiltrated over HTTP POST. Some variants also added keylogging, with captured keystrokes exfiltrated alongside card data. FindPOS obfuscates stolen information prior to transmission using Base64 encoding combined with single-byte XOR.
From version 5.57 onward, FindPOS also gained the ability to download and execute additional payloads, expanding it beyond pure card scraping into a broader post-compromise tool for POS intrusions. Related samples sharing installation and communications characteristics have also been observed collecting remote-access account information, suggesting overlap with tooling used to maintain or expand access to retail payment environments. FindPOS is not regarded as especially sophisticated, but its continued development, persistence mechanisms, memory-scraping behavior, keylogging capability, and use against POS systems make it a significant threat to retail and payment-processing organizations. The malware has also been observed using self-signed TLS certificates in command-and-control communications.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Upon execution, FindPOS will generate a lowercase alphabetic executable name of eight characters... This executable name is then compared against the original executable name... FindPOS proceeds to copy itself to the following directories using the executable name that was previously generated.
In the event a process is not filtered, memory is scraped via calls to VirtualQueryEx and ReadProcessMemory.
The malware in question has the ability to scrape memory for track data... When a card is swiped on a POS terminal, and the transaction is processed, the card data will often reside in memory unencrypted for a brief period of time.
Over the last six years there has been an increased shift by malware authors to secure their C&C communications using the SSL/TLS protocol to stymie detection and blend in with normal traffic.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The State of SSL/TLS Certificate Usage in Malware C&C Communications AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
Point-of-sale malware for Windows-based POS terminals that scrapes process memory for payment card track data, exfiltrates stolen data via HTTP POST, and in later versions adds keylogging. It also supports downloading and executing additional payloads.
Point-of-sale malware using SSL/TLS with self-signed certificates; notable for an anomalous certificate with negative validity period.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.