H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

FrameworkPOS

[FrameworkPOS](https://attack.mitre.org/software/S0503) is a point of sale (POS) malware used by [FIN6](https://attack.mitre.org/groups/G0037) to steal payment card data from sytems that run physical POS devices.(Citation: SentinelOne FrameworkPOS September 2019)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[FrameworkPOS](https://attack.mitre.org/software/S0503) is a point of sale (POS) malware used by [FIN6](https://attack.mitre.org/groups/G0037) to steal payment card data from sytems that run physical POS devices.(Citation: SentinelOne FrameworkPOS September 2019)

Labels

malware
6 recorded

Relationships

uses
from FIN6
Group
uses
to Archive via Custom Method
Technique
uses
to Data from Local System
Technique
uses
to Exfiltration Over Alternative Protocol
Technique
uses
to Local Data Staging
Technique
uses
to Process Discovery
Technique
3 external

References

mitre-attack
S0503
open
Trinity
—
SentinelOne FrameworkPOS September 2019
https://labs.sentinelone.com/fin6-frameworkpos-point-of-sale-malware-analysis-internals-2/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance