Threat Spotlight: PoSeidon, A Deep Dive Into Point of Sale Malware
Summary: Cisco Talos detailed PoSeidon, point-of-sale malware that begins with a Loader binary which establishes persistence, contacts a hardcoded command and control server, and downloads a second binary called FindStr. FindStr installs a keylogger, scans the memory of the PoS device for sequences that could be credit card numbers, verifies them, and sends the keystrokes and card numbers XORed with 0x2A and base64 encoded to an exfiltration server.
Why it matters: The malware targets the magnetic-stripe data read at the point of sale, which criminal markets buy because it can be re-encoded onto new cards, and Talos notes PoS incidents are on the rise across both large organizations and small mom-and-pop establishments. A BinDiff comparison of Loader 11.4 and FindStr 7.1 found 62% of functionality in common, suggesting the actors built core code as a reusable library for further projects.
Read the original at Cisco Talos ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026