New versions of the Prilex point-of-sale malware can block secure contactless NFC-enabled credit card transactions, forcing consumers to insert their credit cards into the machine. Hackers then steal their information.
See also: Google Fi: Hackers had access to customer information
Payment terminals now offer the convenience of contactless transactions, using NFC (Near Field Communication) chips embedded in credit cards, mobile devices, and even smartwatches, to quickly make payments with a simple touch.
See also: Phishing attacks are getting frighteningly sophisticated
Since the pandemic began, contactless payments have seen incredible growth with $34.55 billion in transactions recorded this year alone - a testament to their convenience and growing popularity .
However, the use of NFC chips in credit cards has become a barrier to point of sale (PoS) malware that steals your payment information. As a result, cybercriminals are devising innovative schemes to steal your confidential data.
Kaspersky, closely monitoring the Prilex PoS malware, reports seeing at least three new variants, with version numbers 06.03.8070, 06.03.8072, and 06.03.8080, first released in November 2022.
These new variants introduce an innovative feature that prevents payment terminals from processing contactless transactions, making it necessary for shoppers to insert their cards.
Additionally, Kaspersky revealed that in September 2022, Prilex began using EMV encryption production to evade transaction fraud detection and perform “GHOST transactions” even when the card is secured with CHIP and PIN technology.
When the new Prilex feature is enabled, it will block contactless transactions and display the error “Contactless error, insert your card” on the payment terminal.
This coercive tactic forces the victim to validate their purchase by entering a credit card, giving hackers an easier opportunity to steal this sensitive information with a payment terminal.
This malware uses a rule-based file to determine whether to block a transaction based on whether it has detected NFC use.
Prilex providers block NFC transactions because these create a unique ID or card number that is only valid for a single transaction, so if this data is stolen, it would be of no use to fraudsters.
After obtaining credit card details, Prilex operators follow previous methods, such as cryptographic adaptations and “GHOST transaction” attacks.
A notable feature seen only in the most modern variants of Prilex is their ability to filter out unwanted cards and only get information from specific providers.
See also: New Sh1mmer ChromeBook exploit unenrolls managed devices
Those making a payment find it nearly impossible to protect themselves from PoS malware like Prilex, as there is currently no evidence that a payment terminal may be infected.
Protecting a Business from PoS Malware
The best way to protect your business from PoS malware is to use an effective security solution that can detect and block any suspicious activity. This includes installing software on all computers connected to the company’s network, as well as regularly updating existing systems with the latest security patches and updates. Additionally, businesses should consider using two-factor authentication for their point-of-sale systems, as this adds an extra layer of protection against potential threats. Finally, companies should also ensure that they have adequate firewalls in place to prevent malicious traffic from entering their networks.
Information source: bleepingcomputer.com
