How do attackers use RawPOS?

How RawPOS turns a payment terminal into a card-data source

RawPOS is useful to attackers because it is built for memory scraping on point-of-sale systems. Once it lands on a terminal, the malware watches process memory for payment card data while transactions are in flight. That makes the payment application, not just the endpoint, part of the exposure surface, because the malware targets data before it is protected by downstream controls.

On a live POS system, the attacker’s objective is usually to harvest track data quickly and quietly, then move it out for fraud. That means the most important failure condition is not just infection, but sustained access to terminals that handle card-present transactions. Malware Guide is the natural broader reference for understanding how loaders, payloads and evasion techniques fit that kind of intrusion.

RawPOS style activity is also consistent with the broader pattern described in The State of NHI & AI Agent Breach Report 2026, where attackers take advantage of the identities and access paths that let them reach high-value systems. In a POS environment, the practical issue is not the malware family name alone, but whether the attacker can keep a foothold long enough to scrape memory, stage the stolen data, and exfiltrate it without triggering controls.

Why point-of-sale malware is attractive for fraud operators

Payment terminals are high-value targets because card data has immediate monetisation value. Malware that can read memory during authorization windows can capture track data before it is encrypted or tokenised for storage, which lets attackers bypass many protections that only govern data at rest. The fraud value is highest when the malware reaches multiple terminals in the same retail or hospitality estate.

Attackers also benefit from the operational reality of POS fleets: long-lived devices, predictable software stacks, and tight uptime constraints. Those conditions reward malware that is lightweight, persistent and difficult to notice in normal transaction flow. CISA cyber threat advisories remain a useful source for tracking the wider threat patterns that routinely affect endpoint and payment environments, even when the malware family changes.

Once track data is collected, the attacker’s next problem is not collection, but concealment. Exfiltration from a payment terminal is often easier to detect than the scraping itself, so defenders should think in terms of the full chain: infection, memory access, staging, outbound transfer and fraud conversion. That is why network segmentation and process restrictions matter together, rather than as isolated controls.

What defenders should watch for on infected payment systems

The most practical signals come from abnormal processes and unusual outbound behavior on systems that should be tightly constrained. Unauthorised binaries running on a payment terminal, unexpected child processes, or sudden outbound transfers from a card-handling host are all signs that the terminal may already be in the collection or exfiltration phase. In many cases the malware is easier to spot by what it should never need to do than by a file hash alone.

Defenders should also treat lateral movement pressure as part of the problem. If one POS endpoint is compromised and the network allows broad reach into other terminals, the attacker can scale the scrape-and-exfiltrate pattern across the estate. MITRE ATT&CK Enterprise Matrix is the right reference for mapping that kind of credential access, lateral movement and defence evasion behavior.

For environment hardening and containment, NIST SP 800-207 Zero Trust Architecture is relevant because the practical defense is to reduce implicit trust between terminals, back-office systems and management tooling. Micro-segmentation and least privilege do not stop memory scraping by themselves, but they can stop one infected terminal from becoming a fleet-wide incident.

Risk and Threat Considerations

RawPOS is dangerous because point-of-sale malware can convert a single endpoint compromise into payment-card theft at scale. The key risk is not only data exposure in memory, but the attacker’s ability to remain resident long enough to harvest many transactions and move the data off the environment before detection.

Failure mechanism: The malware sits on a transaction host, reads card data from memory during processing, and uses outbound connectivity or staging steps to extract the stolen tracks before defenders notice abnormal activity.

Impact: Stolen card data can be used for counterfeit fraud, chargebacks, customer harm and costly incident response, and the compromise can spread if POS systems share weak segmentation or common management paths.

Practitioner Guidance

What to prioritise: Treat POS containment as a fraud-prevention problem first, not just an endpoint hygiene problem. If a terminal can reach other terminals, shared admin tools or external destinations, the blast radius is already larger than the malware family itself.

What to verify: Confirm that payment terminals only run expected processes, only communicate with approved services, and cannot initiate arbitrary outbound connections. If any of those assumptions are false, validate the estate as potentially exposed rather than waiting for proof of theft.

Decision rule: If you see unexpected processes or outbound transfer attempts from a card-handling system, isolate the terminal, preserve evidence, and rotate any credentials or remote-access material that could let the same foothold persist across the POS fleet.

Practitioner takeaway: The useful question is not whether RawPOS is present, but whether your POS environment can prevent one infected terminal from becoming a repeatable card-data collection point.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?