Pillowmint — Malware Profile

Pillowmint is a point-of-sale malware used by FIN7 designed to capture credit card information.

MITRE ATT&CK techniques (15)

• T1005 Data from Local System
• T1012 Query Registry
• T1027 Obfuscated Files or Information
• T1027.011 Fileless Storage
• T1027.015 Compression
• T1055.004 Asynchronous Procedure Call
• T1057 Process Discovery
• T1059.001 PowerShell
• T1070.004 File Deletion
• T1070.009 Clear Persistence
• T1106 Native API
• T1112 Modify Registry
• T1140 Deobfuscate/Decode Files or Information
• T1546.011 Application Shimming
• T1560 Archive Collected Data

IntelFusions coverage

• Carbanak and FIN7: Inside the TTPs of Financially Motivated Threat Groups Targeting Banks, Retail, and Hospitality 2026-02-16

Attributed threat actors

• FIN7

Read the full analysis on IntelFusions