Prilex POS malware evolves to block contactless transactions

A new version of the Prilex POS malware has found a novel way to steal your credit card information.

According to Kaspersky, Prilex is a Brazilian threat actor that initially began in 2014 as an ATM-related malware and later switched to modular point-of-service malware. The threat actor was responsible for one of the biggest attacks on ATMs in Brazil, infecting and jackpotting more than 1,000 machines and cloning more than 28,000 credit cards used in the ATMs.

SEE: Mobile device security policy (TechRepublic Premium)

Prilex is particularly experienced with payment markets, electronic funds transfer software and protocols, and the threat actor has recently updated its POS malware to block contactless transactions to steal your credit card information.

Jump to:

What’s new in the latest Prilex malware

Contactless payment methods have become incredibly popular, especially since the COVID-19 pandemic when people wished to touch as public surfaces as possible. Such payments require the credit card to be really close to the payment device, which is typically a POS terminal.

As contactless payments are not handled by the POS terminal in the same way as usual payments, it’s not possible for cybercriminals to abuse and make fraudulent use of the system. This resulted in cybercriminals’ POS malware seeing a huge decrease in the number of transactions it could abuse.

Prilex malware developers have found a way to deal with this problem: The malware, once it sees a contactless transaction happen, blocks it. The PIN pad then tells the user that there is a contactless error and that the payment needs to be done by inserting the credit card. Once the victim pays by card, a GHOST transaction fraud can be operated by Prilex.

In GHOST transactions, the malware sits on the device, intercepting all communications between the POS software and the PIN pad. Once a transaction is ongoing, the malware intercepts the transaction content and modifies it in order to capture the credit card information and request new EMV cryptograms to the victims card. The new EMV cryptogram enables the attacker to initiate a new fraudulent transaction from a POS device they own (Figure A).

Figure A

How do POS malware infections work?

POS malware is not your average malware. Developing it requires a deep understanding of the whole payment market as well as its protocols, tools and deployment. As such malware is useless on usual endpoints, it needs to be executed on the computers who actually run the POS software and deal with payments.

The cybercriminals behind advanced POS malware cannot just send phishing emails to infect computers; they need to target specific people and use social engineering schemes to entice the victim to install a legitimate remote desktop application before infecting it. This explains why the fraudsters generally pretend to be technicians who need to update the legitimate POS software.

How to protect your organization from this threat

The end customer can not do anything against the threat, as it happens on infected devices that they can’t control. All protection must come from administrators of POS software.

As a company using POS systems, establish a detailed process with the POS provider in order to avoid any social engineering scams. All contacts between the POS software customer and the POS software provider need to follow specific rules that should be discussed over a secure channel and known by anyone who could access the devices running the POS software. Should any cybercriminal call and pretend to be an employee of the POS software supplier, this would help to immediately discover them.

Security solutions should be deployed on all devices running POS software to try to detect malware infection. As information is sent from an infected POS device to an attacker owned C2, network communications should also be monitored in order to detect any suspicious activity that could be a communication between a malware and a C2 server.

Finally, all software and operating systems should always be up to date and patched in order to avoid compromise by common vulnerabilities.

Disclosure: I work for Trend Micro, but the views expressed in this article are mine.