Cyber-thieves to target Christmas shoppers

Cyber-thieves are preparing malware and spam campaigns in a bid to catch out retailers and shoppers during the run-up to Christmas, experts say.

One gang had updated the sophisticated malware it used to target tills in stores, security company iSight said.

There had also been an increase in spam and phishing emails crafted to catch out people seeking bargains.

And some crime groups had made fakes copies of popular shopping apps in a bid to steal payment-card data.

The warnings are being given just prior to Black Friday and Cyber Monday, which bracket the weekend following the US Thanksgiving holiday, when many online and offline stores offer special deals.

Cashing in

The 50 biggest retail brands in the US were now hunting through their internal corporate networks to see if they had been infected by the “highly sophisticated” Modpos malware, said iSight senior director Stephen Ward.

The modular malware could lurk unseen on point-of-sale equipment, said Mr Ward, and sought to scoop up payment-card data during the few moments this information was passed around unencrypted in the memory of computerised tills.

“It’s a Swiss-army knife of sorts that can be used for any type of nefarious activity,” he said.

The Retail Cyber Intelligence Sharing Center, a US government-backed organisation set up to pass on information about threats aimed at retailers, hassent out advice about the “2015 hacking season”.

“Downtime is expensive, but especially so at this time of year,” it said.

“Retail staff is motivated and focused on sales, at the risk of possibly allowing fraudulent transactions or other types of breaches.”

Reacting quickly to threats could be tricky at this time of year, it said, because systems were often “frozen” to limit downtime.

Mr Ward said iSight had been tracking the gang behind Modpos for some time, but it had now been revamped for the run-up to Christmas.

And traditional anti-virus systems were unlikely to catch the stealthy malware because of the clever way it was built.