CherryPicker POS

Last reviewed: October 2, 2026

CherryPicker POS is a type of malware specifically designed to target Point of Sale (POS) systems. POS systems are used by businesses to process transactions and manage sales data. CherryPicker POS malware is known for its ability to steal sensitive payment card information from these systems. The malware has been active for several years and is part of a broader category of threats known as POS malware, which targets the retail and hospitality sectors. As of October 2023, CherryPicker POS remains a concern for businesses that rely on POS systems for their operations.

Overview

CherryPicker POS is a sophisticated malware strain that targets Point of Sale systems to exfiltrate payment card data. This type of malware is typically used by cybercriminals to collect credit and debit card information, which can then be sold on the black market or used for fraudulent transactions. CherryPicker POS is known for its stealthy operation and ability to evade detection by traditional security measures. It is part of a broader trend of cybercriminals targeting POS systems, which are often seen as vulnerable entry points for data theft.

History

CherryPicker POS first emerged in the cybersecurity landscape several years ago. Its development and deployment have been attributed to organized cybercriminal groups, although specific attribution remains unconfirmed. The malware has evolved over time, with new variants appearing to enhance its capabilities and evade detection. CherryPicker POS has been involved in several high-profile data breaches, highlighting the ongoing threat it poses to businesses in the retail and hospitality sectors.

Technical characteristics

CherryPicker POS is designed to operate covertly within a POS system. It typically uses memory scraping techniques to capture payment card data as it is processed by the system. This involves scanning the system's memory for unencrypted card data, which can then be extracted and sent to a remote server controlled by the attackers. The malware is often equipped with features to avoid detection, such as the ability to delete itself after execution and mechanisms to bypass antivirus software.

Infection vector

The primary infection vector for CherryPicker POS is through compromised remote access credentials. Cybercriminals often gain access to POS systems by exploiting weak or stolen credentials, allowing them to install the malware remotely. In some cases, attackers may use phishing emails or exploit vulnerabilities in the POS software to gain initial access. Once installed, CherryPicker POS can spread laterally within a network, compromising additional systems and increasing the scope of the data breach.

Notable campaigns

CherryPicker POS has been linked to several significant data breaches affecting businesses in the retail and hospitality sectors. These campaigns often involve the theft of large volumes of payment card data, which can have severe financial and reputational consequences for the affected organizations. While specific details of these campaigns are often not publicly disclosed, they underscore the persistent threat posed by CherryPicker POS and the need for robust security measures to protect POS systems.

Detection and mitigation

Detecting CherryPicker POS can be challenging due to its stealthy nature. However, businesses can implement several measures to reduce the risk of infection. Regularly updating POS software and applying security patches can help close vulnerabilities that the malware might exploit. Implementing strong password policies and using multi-factor authentication can protect remote access credentials. Network segmentation can limit the spread of the malware within an organization. Additionally, deploying advanced security solutions that use behavioral analysis can help identify and block suspicious activity associated with CherryPicker POS.