Slicing Into a Point-of-Sale Botnet
Summary: A point-of-sale botnet tracked since November 2015 has infected more than 100 systems, at least half running a malicious Windows process called cicipos.exe, and its control panel held more than 1.2 million unique credit and debit card numbers logged since early April 2016. KrebsOnSecurity could not conclusively tie the botnet to CiCi's Pizza, but several people named in the logs, including Richard Higgins of Prattville, Ala., confirmed eating at CiCi's locations on the dates their card data was captured, and POS provider Datapoint POS said the attackers used social engineering and Team Viewer to trick store employees into installing the malware.
What you should know: More than 1.2 million card numbers sat in a single botnet's logs, and roughly half of them came from compromised CiCi's locations alone - a reminder that the entry point was not a sophisticated exploit but employees letting supposed technicians into their registers.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026