ModPipe
- Malware type
- credential-stealer
- Family
- Malware family
- Profile updated
- 2026-07-07 15:12:14
Targeted industries: retail-and-hospitality
Context
ModPipe is point-of-sale (POS) malware capable of accessing sensitive information stored in devices running ORACLE MICROS Restaurant Enterprise Series (RES) 3700 POS – a management software suite used by hundreds of thousands of bars, restaurants, hotels and other hospitality establishments worldwide. ModPipe uses modular architecture consisting of basic components and downloadable modules. One of them – named GetMicInfo – contains an algorithm designed to gather database passwords by decrypting them from Windows registry values. Exfiltrated credentials allow ModPipe's operators access to database contents, including various definitions and configuration, status tables and information about POS transactions.
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Modpipe (report)
- kroll.com — Modpipe Pos Malware New Hooking Targets Extract Card Data (report)
- ESET — Hungry Data Modpipe Backdoor Hits Pos Software Hospitality Sector (report)
- foregenix.com — Modpipe Malware Has A New Module That Siphons Payment Card Data (report)