Tor-enabled malware stole credit card data from PoS systems at dozens of retailers