Credit card data breaches are a recurring cybercrime that is affecting millions of people. The criminal’s goal is to steal the Tracks 1 & 2 data on the magnetic stripe of the credit card, optionally clone the card, and run charges on the account associated with the card. One of the ways criminals steal Track data is by using Point of Sales (POS) RAM Scraper malware. “The Payment Card Industry Data Security Standard (PCI-DSS) is a set of requirements designed to ensure that ALL companies that process, store, or transmit credit card information maintain a secure environment”. PCI-DSS does not offer new secure technology to protect electronic payment systems; instead it provides requirements for building up layers of security controls around existing technologies. The criminals discovered a weakness within this layered security framework – unencrypted Track data residing in the RAM of POS systems. POS RAM Scraper malware uses regular expression matches/custom search functions to harvest Track data from process memory space in the RAM. In this talk we present a comparative study of eleven major POS RAM Scraper malware families discovered between 2011-2014. We do a deep technical inspection of the different functionalities found in these families to discover how they install, steal data, and exfiltrate the stolen data. By mapping out common functionalities and identifying new functionalities in these families, we make predictions about what NextGen POS RAM Scraper malware will look like. By predicting POS RAM Scraper malware evolution, we can create policies, procedures, and products to safeguard against future attacks.