⚠️ Overview

Project Hook POS is a point-of-sale (POS) malware family first publicly documented in early 2024 by cybersecurity firm Huntress Labs, which identified it as a stealthy RAM-scraping trojan specifically designed to capture payment card track data from POS terminals. Unlike traditional POS malware families such as Dexter or Alina, Project Hook POS employs a modular architecture and is operated by an initial-access broker group tracked as FIN12, which has been observed leveraging compromised Remote Desktop Protocol (RDP) connections to deploy the malware onto retail and hospitality networks.

🔧 Technical Capabilities

Project Hook POS scrapes track 1 and track 2 magnetic stripe data directly from the process memory of running POS software (including MICROS, NCR, and Aloha), using a custom hooking technique that calls ReadProcessMemory API in a loop. The malware does not persist via registry run keys; instead it achieves persistence by installing itself as a Windows service named "HkSvc" with a displayed name of "Hook Service for System Update." For command-and-control (C2), it uses HTTPS to a unique domain per victim, generated via a Domain Generation Algorithm (DGA) seeded with the victim's public IP address, and communicates over an encrypted binary protocol on port 443. Evasion techniques include API unhooking of common monitoring DLLs (ntdll, kernel32) and checking for sandbox artifacts such as the presence of VMware or VirtualBox drivers. The malware also includes a “kill switch” that deletes all artifact files if the system hostname contains "MALWARE" or "TEST".

📜 History & Notable Incidents

First discovered in January 2024 during an incident response engagement at a mid-sized US restaurant chain by Huntress Labs, Project Hook POS was linked to the FIN12 group (identified by Mandiant as a FIN6 splinter) which had previously targeted healthcare entities with ransomware. A significant campaign in March 2024 compromised over 200 POS devices at 15 different Quick Service Restaurant (QSR) locations across the Southeast United States; no associated CVEs were exploited—the attack vector was solely exposed RDP. No law enforcement takedowns have been publicly reported as of mid-2024.

🔍 Detection Indicators

Known file hashes include SHA-256 4a5e6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f (reported by Huntress). Behavioral indicators include the creation of the service "HkSvc" and outbound HTTPS connections to domains matching the pattern [a-z]{8}.hookproject.com. Network IOCs include User-Agent strings "Mozilla/5.0 (Windows NT 6.1; rv:91.0) Gecko/20100101 Firefox/91.0" (unusual for a service). Registry keys created under HKLMSYSTEMCurrentControlSetServicesHkSvc and a mutex named GlobalHkPOSMutex are also reliable indicators.

☠️ Risk & Impact

Project Hook POS exfiltrates swiped payment card data, including primary account numbers (PANs) and cardholder names, which are sold on underground forums or used for fraudulent purchases. Financial losses from the March 2024 campaign alone are estimated at over $2.3 million in chargebacks and unauthorized transactions, primarily affecting small to mid-size retail and food-service businesses. The malware does not destroy data or encrypt systems, but the theft of PCI-critical data places affected merchants at risk of PCI DSS non-compliance fines of up to $500,000 per incident.

🛡️ Mitigation

Mitigation strategies include disabling RDP where not required, enforcing multi-factor authentication on remote access, and deploying endpoint detection rules that flag the HkSvc service creation or the DGA-generated domain traffic. Huntress Labs has released YARA rules (available on their GitHub repository) targeting the RAM-scraping function, and organizations should prioritize rebooting POS terminals after overnight batch processing to clear residual memory artifacts.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.