Sophisticated New Scam Targets Retailer Payment Systems Just in Time for Black Friday

There's a new and sophisticated virus out there that's targeting point-of-sale payments, just in time for the holiday season.

Using a malware virus that goes so deep into the computer's systems that most antivirus software overlooks it, this new scheme is the most advanced ever seen, according cybersecurity company iSight. Not only is the malware deep within the computer architecture, but it's also very encrypted, making it even more difficult to identify it as a virus. Essentially, it can scrape information that passes through the checkout terminal and even record what you type into the keypad.

With Black Friday approaching fast, this comes at an inopportune time, putting pressure on the cybersecurity companies who don't want another massive data breach to happen again, like it did in 2013 at Target, which resulted in a massive $10 million settlement to the customers.

Since October, when the credit card industry made the switch to EMV credit cards—the ones with the chip—that offer increased security at payment terminals, the burden on who is responsible for fraudulent charges shifted onto the retailer, not the payment provider, if the store hasn't updated to the new system. Still, EMV cards don't completely safeguard consumers and retailers from this kind of virus. According to iSight, information skimmed or taken in an unencrypted portion of the network—not all are secure yet—can be used to make an online purchase.

This is still a big deal because only around 20% of retailers are ready with the new, more secure terminals, opening them up to a big problem should the malware skim customer credit cards.

For most of this year, iSight has been tracking this scam and traced it to eastern Europe, and has been partnering with retailers to make sure an attack like Target's doesn't happen again.

According to the New York Times, the team had a breakthrough in September, which led to an almost month-long cracking campaign in which they uncovered other malware that targets points-of-sale. Unfortunately the findings showed the malware was so diverse that it could penetrate many different parts of a company's network—not just the point-of-sale. Needless to say, cyber-threats are not going away anytime soon.