These are likely using hooking. They don't scan RAM all the time, instead they patch or inject code into the POS software and then record the data when that code is called.
Think of something like Microsoft Detours. RAM scrapers seems a pretty inaccurate description.
> Once on a targeted system, RAM scrapers work by examining the list of processes that are running on the system and inspecting the memory for data that matches the structure of credit card data, such as the account number, expiration date, and other information stored on a card’s magnetic stripe.
No hooking, sounds exactly like they're looking through the memory assigned to each process looking for the right looking data.
I suspect that is just an oversimplification, of course, unless they post the malware in question I can't really say for sure.
further reading: http://www.trendmicro.com/cloud-content/us/pdfs/security-int...