Point-of-sale malware strains AlinaPOS and JackPOS have been detected on more than 4,000 ElasticSearch servers, with 99% hosted in Amazon Web Services, according to security researchers Kromtech. Each infected server becomes part of a bigger PoS botnet, able to collect, encrypt and transfer credit card information. The new version of the malware, dubbed “Alina,” is designed for use by criminals who want to steal data from online retailers like Amazon, eBay or PayPal.
Point-of-sale malware strains AlinaPOS and JackPOS have been detected on more than 4,000 ElasticSearch servers, with 99% hosted in Amazon Web Services, according to security researchers Kromtech. Each infected server becomes part of a bigger PoS botnet, able to collect, encrypt and transfer credit card information. The team found more than 15,000 ElasticSearch servers with no authentication and password protections, while recent updates to AlinaPOS and JackPOS enable them to automatically scan for unprotected systems.