{
  "family": "cardspy",
  "sample_count": 44,
  "category": "infostealer",
  "description": "CardSpy is a specialized payment card and financial surveillance trojan active since 2013. Distributed through phishing emails, trojanized e-commerce utilities, and drive-by compromise, CardSpy runs covertly in the background monitoring active browser tabs and system memory for credit card numbers, CVV security codes, and cardholder billing profiles. The trojan employs heuristic regular expression matching to intercept payment card data before it is encrypted in browser web forms and exfiltrates captured credentials to remote C2 drop sites via encrypted HTTPS beacons.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/CardSpy",
    "Trojan.Win32.CardSpy",
    "PWS:Win32/CardSpy",
    "Win32/CardSpy"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/CardSpy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CardSpy is a specialized financial spyware trojan designed to intercept credit card and billing details entered into browsers."
      }
    },
    {
      "@type": "Question",
      "name": "How does CardSpy capture credit card data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors browser forms and memory buffers using regular expressions matching Visa, MasterCard, and Amex card patterns."
      }
    },
    {
      "@type": "Question",
      "name": "How does CardSpy exfiltrate stolen card information?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It packages the credit card numbers, CVV codes, and expiry dates into encrypted HTTPS POST requests sent to C2 drop boxes."
      }
    },
    {
      "@type": "Question",
      "name": "How do computers become infected with CardSpy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through malicious email attachments, cracked software utilities, and drive-by web exploit downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be disinfected from CardSpy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run an antimalware scan to quarantine dropped binaries, remove startup registry entries, and notify bank card issuers."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1555.003",
    "T1055",
    "T1547.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactic": "Collection"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly sever the compromised PoS terminals from all external networks and internal corporate networks to halt exfiltration.",
    "Do NOT reboot the infected PoS terminals immediately; capture full forensic memory images of the live systems to extract the RAM scraping regex and the stolen data logs.",
    "Initiate standard Incident Response protocols for a major PCI-DSS breach, including notifying acquiring banks and legal counsel.",
    "Audit all remote access pathways (e.g., RDP, TeamViewer) to the PoS environment to determine how the attackers achieved initial access."
  ],
  "what_to_avoid": [
    "Do not wipe and reimage the PoS terminals before a forensic investigation is complete; determining the scope of the stolen card data is legally required.",
    "Avoid assuming the infection is limited to one terminal; PoS malware is typically deployed via a central management server to the entire fleet."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Financial Theft & Payment Card Fraud",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Trojanized Financial Tools",
    "Drive-By Web Exploits"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Payment Card Regex Pattern Matching",
    "Web Browser Form Interception",
    "In-Memory Credential Scraping",
    "Encrypted HTTPS Exfiltration",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTPS POST requests transmitting encrypted JSON card records to remote C2 drop boxes"
    ],
    "evasion_techniques": [
      "Process injection into browser helper processes",
      "In-memory string matching without local disk logging",
      "XOR encryption of C2 configuration strings"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\CardSpy\\card_agent.exe",
        "%Temp%\\card_buf.tmp"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CardSpyAgent"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Card Stealer Framework"
    ],
    "variants": [
      "CardSpy.A",
      "CardSpy.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "cd23de45fa567890123456789abcdef0123456789abcdef0123456789abcdef01",
      "de34fa56ab67890123456789abcdef0123456789abcdef0123456789abcdef012"
    ],
    "delivery": [
      "e_commerce_pos_patch.exe",
      "order_payment_receipt.scr"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CardSpyAgent"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/CardSpy",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/CardSpy"
    },
    {
      "name": "Threat Intelligence Database - Trojan.CardSpy",
      "url": "https://www.virustotal.com/gui/file-analysis"
    }
  ]
}