NFC

Cybersecurity researchers have identified a new Android malware strain called NGate, which threatens contactless payment systems by intercepting and relaying payment data from victims' credit and debit cards to attackers' devices. This malware is linked to a targeted campaign against three banks in Czechia and operates through a malicious application installed on victims' Android devices. NGate has been active since November 2023, with its first recorded instance in March 2024. It aims to clone near-field communication (NFC) data from payment cards, allowing attackers to withdraw funds from ATMs. The attack methodology involves social engineering and SMS phishing, misleading victims into installing NGate through deceptive links. Researchers identified six different NGate applications before the arrest of a suspect for ATM-related theft. NGate captures NFC traffic and prompts users to input sensitive financial information through a WebView interface. Victims are often contacted by impersonators posing as bank employees, further manipulating them into providing information. NGate operates using two servers: one for phishing and another for redirecting NFC traffic. Additionally, a new variant of the Copybara Android banking trojan has been reported, which uses voice phishing attacks and the MQTT protocol for communication.