New Android Malware Exploits NFC to Steal Payment Card Data: A Novel Threat to Mobile Banking Security

New Android Malware Exploits NFC to Steal Payment Card Data: A Novel Threat to Mobile Banking Security

A newly identified Android malware, named NGate by security firm ESET, introduces a novel and dangerous method of stealing payment card data. This malware leverages an infected device's Near-Field Communication (NFC) reader to capture card details, effectively cloning the card for unauthorized use at ATMs or point-of-sale terminals. This innovative attack marks a significant development in the landscape of mobile banking threats.

NGate Malware: How It Works

NGate incorporates NFCGate, an open-source tool designed for capturing, analyzing, or altering NFC traffic. NFC, short for Near-Field Communication, allows two devices to wirelessly communicate over short distances, a technology commonly used for contactless payments. NGate exploits this technology by relaying NFC data from a victim's card through a compromised device to an attacker’s smartphone. The attacker can then emulate the victim's card, withdrawing money from an ATM without physically possessing the card.

Attack Scenario and Methodology

ESET researchers highlighted that NGate represents a new Android attack scenario, being the first known instance of malware with this capability being deployed in the wild. The malware typically infiltrates devices through traditional phishing techniques, where attackers send messages that trick users into installing NGate from fake domains that mimic legitimate banking apps. Once installed, the malware masquerades as a banking app, prompting the user to enter sensitive information such as their banking client ID, date of birth, and PIN code. It then instructs the user to activate NFC and scan their card, capturing the card’s data.

Attack scenario and methodology 
Image credit: ESET

NGate’s Impact and Spread

The malware has been detected targeting three Czech banks since November 2022, with ESET identifying six different versions of NGate circulating between then and March 2023. Later versions of the malware were distributed as Progressive Web Apps (PWAs), which can be installed on both Android and iOS devices, even when non-official app installations are restricted. The NGate campaign appears to have ended in March, likely due to the arrest of a 22-year-old in Prague by Czech police. The suspect was caught wearing a mask while withdrawing money from ATMs, allegedly using the NGate method.

The Phishing Tactics Behind NGate

ESET researchers, including Lukas Stefanko and Jakub Osmani, detailed the phishing tactics employed by attackers. The scheme began with SMS messages sent to potential victims, linking to phishing websites that impersonated banks. These links likely led to the malicious PWAs. Once the victim installed the app and entered their credentials, the attacker gained access to their account. Posing as a bank employee, the attacker would then contact the victim, claiming their account had been compromised and instructing them to download NGate to "protect" their funds by changing their PIN and verifying their banking card.

Phishing tactics behind NGate
Image credit: ESET

Broader Implications: Cloning Smart Cards

The NGate malware or similar apps could be repurposed to clone other types of smart cards, such as those used for public transportation, ID badges, or membership cards. During testing, researchers successfully relayed the unique ID (UID) from a MIFARE Classic 1K tag, commonly used for these purposes. This method could allow attackers to access secured premises by emulating the UID of an NFC token read at a different location.

Conclusion: Mitigating the NGate Threat

While the NGate attack requires the attacker to have a rooted and customized Android device, phones infected by NGate do not require this setup, making the threat accessible to a broader range of attackers. This new malware highlights the evolving risks in mobile banking security, emphasizing the need for enhanced protective measures against phishing and NFC-based attacks. As digital banking continues to grow, staying vigilant against such sophisticated threats is more crucial than ever.