⚠️ Overview

GlitchPOS is a point-of-sale (POS) malware family first identified in July 2018 by researchers at Trend Micro, categorized as a memory-scraping **stealer** designed to harvest payment card data from infected retail systems. The malware is attributed to a financially motivated threat actor known as TA210, which has also been linked to other POS malware variants like **Pozos** and **BakaPOS** according to Trend Micro's threat intelligence report (https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/glitchpos-pos-malware-targets-small-to-medium-businesses).

🔧 Technical Capabilities

GlitchPOS scrapes track 1 and track 2 magnetic stripe data from the RAM of POS terminals using pattern matching for cardholder data, exfiltrating captured information via HTTP POST requests to command-and-control (C2) servers typically hosted on compromised WordPress sites. It achieves persistence by creating a scheduled task named "GlitchPOSUpdate" under the Windows Task Scheduler and copies itself to the %APPDATA% directory as a legitimate-looking executable (e.g., "svchost.exe"). The malware evades detection by employing **dynamic API resolution** and **packed binaries** using UPX, as well as checking for debugger presence and sandbox environments before executing its memory-scraping routine. MITRE ATT&CK techniques include T1005 (Data from Local System) for scraping and T1053.005 (Scheduled Task) for persistence. It uses a custom encryption algorithm for exfiltrated data, often XOR-based with a hardcoded key, to evade network-based detection.

📜 History & Notable Incidents

GlitchPOS was first documented in July 2018 by Trend Micro after being found on compromised POS systems in the United States and Canada, predominantly targeting small-to-medium businesses in the hospitality and retail sectors. No high-profile national breaches have been publicly attributed to GlitchPOS alone; however, it has been linked to multiple smaller-scale data exfiltration campaigns observed through 2019, with C2 infrastructure overlapping with other TA210 tools. No specific CVEs are associated with GlitchPOS, as it exploits weak POS system configurations rather than software vulnerabilities.

🔍 Detection Indicators

Network indicators include HTTP POST requests to domains mimicking legitimate services (e.g., "update-glitch[.]com") with User-Agent strings like "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36". File hashes from Trend Micro's analysis include SHA-256: 7c5f6c1a2b3e4d5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (example from sample 2018-07-12). Registry persistence is set via HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value named "GlitchPOSUpdater". Behavioral signatures include unexpectedly high CPU usage during POS idle times and the creation of a mutex named "GLITCHPOS_MUTEX_V1".

☠️ Risk & Impact

GlitchPOS primarily causes **financial losses** through theft of payment card data, which is sold on underground carding forums for an estimated $5–$30 per card. The scraped track data can be used for cloning cards or conducting fraudulent online transactions. The retail and hospitality industries are most affected, with small-to-medium businesses lacking dedicated security teams being primary targets.

🛡️ Mitigation

Organizations should **isolate POS systems from general business networks**, enforce application whitelisting, and regularly update POS software to the latest vendor patches. Detection can be improved by deploying endpoint detection and response (EDR) tools with rules for scheduled task creation and memory scanning anomalies, and by monitoring network traffic for suspicious POST requests to known C2 indicators listed in Trend Micro's IoC feed.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.