Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
PunkeyPOS was Windows point-of-sale malware identified in 2016 that searched restaurant payment terminals for card data. A report relayed by SecurityWeek said more than 1.2 million unique credit and debit card numbers had been stolen since early April 2016. That is a reported number of card records—not a verified count of infected restaurants or people. The documented restaurant figures were far smaller, and they refer to separate scopes.
What was PunkeyPOS?
PunkeyPOS was a malware family designed to steal payment-card data from point-of-sale (POS) systems. PandaLabs identified it in 2016 after finding it on restaurant POS terminals in the United States. SecurityWeek’s account of PandaLabs’ analysis describes malware that could run on Windows systems and included more than one way to capture information.
In its Q3 2016 report, PandaLabs said an attack had compromised 200 American establishments, most of them restaurants, and stolen credit and debit card data using PunkeyPOS. SecurityWeek described the analyzed variant as affecting around 200 POS terminals. Those descriptions concern a particular analyzed campaign; they do not establish the total number of businesses ever affected by every PunkeyPOS variant.
What does “millions” mean in the PunkeyPOS reports?
The strongest reported millions-scale figure concerns card numbers. SecurityWeek relayed a KrebsOnSecurity account that bots had stolen more than 1.2 million unique credit and debit card numbers since early April 2016. SecurityWeek also said PunkeyPOS had been active for more than a year and that millions more might have been affected. That larger figure was a possibility, not a verified total.
#1 Best Overall
- With Square Terminal, you can ring up sales, accept payments, and print receipts, all with one device. Use it at the counter or ring up customers anywhere in your store.
- Accept all major credit and debit cards and pay one low rate with no hidden fees and no long-term contracts.
- Process chip cards in just two seconds.
- Get your money as soon as the next business day.
- Use it cordlessly with the built-in battery, designed to last all day.
Card numbers, POS terminals, restaurants, and people are different measures. The reported card count does not tell us how many people were affected: one person may have had more than one card number exposed, and the reporting does not establish a count of individual people. Nor does it mean millions of restaurants were infected.
| 2016 PunkeyPOS figure | What it counts | Scope and qualification |
|---|---|---|
| More than 1.2 million | Unique credit and debit card numbers reportedly stolen | Since early April 2016, according to the KrebsOnSecurity account summarized by SecurityWeek; not a count of restaurants or people. |
| Around 200 | POS terminals in the analyzed variant | SecurityWeek’s summary of PandaLabs’ 2016 findings. |
| 200 | American establishments, most of them restaurants | PandaLabs’ Q3 2016 report on an attack; this is not a count to add to the terminal figure. |
| More than 1,000 | Wendy’s establishments | PandaLabs described a separate attack involving another PunkeyPOS variant. It is a different scope from the approximately 200-terminal analysis. |
The Wendy’s figure should not be added to the approximately 200-terminal figure to produce a combined total: PandaLabs described it as a separate variant and scope, and the figures measure different things. The evidence supports a serious card-theft campaign, not the claim that millions of restaurants were infected.
Rank #2
- Get your money as soon as the next business day.
- Get set up quickly with no long-term commitments. Download the Square Point of Sale app for free, create an account, and start taking payments anywhere.
- Run your business all in one place with the free Square Point of Sale app. Track your sales, manage inventory, accept tips, send receipts digitally, and more.
- Works with Apple devices with a Lightning connector.
How did PunkeyPOS steal payment-card data?
SecurityWeek’s summary of PandaLabs’ analysis describes a sequence focused on data available on an infected Windows POS system:
- Capture input: PunkeyPOS could drop a keylogger, which records keystrokes.
- Search running processes: Its RAM scraper inspected process memory for Track 1 and Track 2 payment-card information. These formats contain card data used in payment transactions.
- Check captured data: The malware could validate whether the material it found looked useful.
- Protect and send the data: It encrypted the material with AES and transmitted it to command-and-control infrastructure.
The analysis also described a server panel operators could use to view stolen information and to update or reinfect POS bots. Researchers were able to access the analyzed command-and-control server because it was improperly configured, according to SecurityWeek.
Rank #3
- MSR90 is a USB emulation keyboard interface that not need any driver or software,USB simply plug and play
- Reads up to 3 tracks of information,can reads ISO7811, AAMVA, CA DMV and most other card data formats
- Threaded inserts for mounting. LED indicator, green light is on when connecting,green light blinks when cards swiped
- Bi-directional swipe reading, superior reading of high jitter, scratched, and worn magstripe cards, reliable for over 1,000,000 card swipes
- Configuration software makes configuration changes easy,works with: Windows OS and Mac OS
How did the restaurants become infected?
SecurityWeek said social engineering may have led unsuspecting employees to install the malware. The reporting did not establish that as the definitive entry route, however, and acknowledged that other infection techniques were possible. It is therefore not accurate to describe one confirmed method by which every affected terminal was infected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How was PunkeyPOS different from online restaurant attacks?
PunkeyPOS targeted local POS systems and searched their running memory for Track 1 and Track 2 card data. A later, separate set of Magecart campaigns targeted online-ordering platforms: Recorded Future documented campaigns exposing at least 311 restaurants in 2022. Those attacks involved web checkout pages rather than PunkeyPOS’s local POS memory-scraping approach, so their restaurant count should not be combined with the PunkeyPOS figures.
Quick Recap
Best Value
- Pay one transparent rate per swipe for Visa, Mastercard, Discover and American Express.
- Works in conjunction with most downloadable Square point-of-sale apps on your device. Customers can pay, tip and sign directly on your device. Track payments in cash, gift cards and more. Also lets you send receipts via e-mail or text message, makes it easy to apply discounts, keeps a data and sales history log and more.
- Accepts magstripe credit card payments, including those from Visa, Mastercard, Discover and American Express (fees apply).
- App sends deposits to your bank account within 1 to 2 business days, or enjoy instant deposits (fees apply).
Rank #4
- USB interface, keyboard emulation, no need to install software to read, configuration software for changing settings available.
- Read data from all 3 tracks, high and low coercivity cards, ISO7811, AAMVA, CA DMV and most magnetic card data formats.
- Work on Windows, Mac and other USB capable systems. Work with TXT, notepad, Word, Excel, POS systems and son on.
- Compact size, with 145cm USB cord, two 3mm-diameter screw holes for fixing at the bottom, a LED indicator light
- Perfect for POS, Banking, Loyalty, Access Control, ID verification and other applications.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
