Loading story…
Criminals are exploiting tap-to-pay technology through a scam known as 'ghost tapping,' which targets both physical payment cards and mobile wallets such as Apple Wallet and Google Wallet. Attackers use NFC readers to trigger unauthorized contactless payments by getting extremely close to victims, often in crowded public spaces. While the technology is designed to be secure, these scams persist due to the ease of obtaining portable NFC readers and the prevalence of tap-to-pay transactions in daily life. Security experts note that although ghost tapping is difficult to execute, the risk remains significant, especially as attackers seek opportunities when users are distracted.
To mitigate the risk of ghost tapping, users are advised to take precautions such as using RFID-blocking wallets, disabling NFC when not in use, and remaining vigilant in crowded environments. The scam has gained increased attention due to its potential to steal funds directly from mobile wallets or cards without the victim's immediate knowledge. Security professionals emphasize the importance of awareness and proactive measures to block unauthorized scanning and protect financial information from these evolving threats.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported on **Ghost Tapped**, an Android malware operation tied to Chinese-speaking threat actors that abuses **NFC** capabilities to facilitate fraudulent tap-to-pay transactions. The malware is designed to compromise Android devices and misuse payment card data on infected phones, allowing attackers to support in-person payment fraud through contactless transaction mechanisms. The report tracks the growth of the campaign and highlights how mobile malware is evolving beyond credential theft and banking overlays into direct abuse of **tap-to-pay** functionality. The activity underscores a broader risk to financial institutions, merchants, and Android users as attackers increasingly weaponize legitimate mobile payment features to conduct fraud at scale.
Jul 12, 2026
Researchers and incident responders reported that the **Smishing Triad** is pairing large-scale SMS phishing with **NFC relay** fraud to monetize stolen payment cards. In Slovakia, attackers impersonated health insurer **VšZP** in fraudulent text messages that led victims to phishing domains including `informacie-poistenca[.]com` and `obnovypoistenca[.]com`, where they were prompted to submit personal data, card details, and one-time passwords. CSIRT.SK said the malicious infrastructure was identified in February 2025 and linked the campaign to reusable phishing kits and hosting associated with other suspicious domains. The stolen card data is then reportedly provisioned into **Apple Pay** or **Google Pay** wallets and used in a cash-out method known as **Ghost Tap**, which relays NFC payment transactions to enable fraudulent contactless purchases. ThreatFabric described Ghost Tap as an emerging tactic in which criminals combine wallet provisioning, relay tooling, and malware such as **ZNFC** to bypass the need for a physical card. Investigators also cited Chinese-language traces and Telegram activity tied to the alias **`wangduoyu8`**, reinforcing attribution links between the phishing operations and the broader China-linked smishing ecosystem.
Jul 24, 2026
Researchers have identified a surge in Android malware abusing Near-Field Communication (NFC) and Host Card Emulation (HCE) to steal payment data and facilitate unauthorized transactions. Over 760 malicious apps have been discovered targeting banks, payment services, and government portals worldwide, including institutions in Russia, Europe, and Brazil. These apps often impersonate trusted organizations, urging users to set them as default NFC payment handlers, and exfiltrate sensitive EMV card data—such as device IDs, card numbers, and expiry dates—via Telegram channels. Attackers remotely control the apps through command-and-control servers, enabling them to relay card terminal requests, provide PINs, and execute fraudulent transactions with minimal user interaction. The rapid adoption of "Tap-to-Pay" has made NFC a lucrative target, with over 70 C2 servers and dozens of Telegram bots coordinating attacks against more than 20 global institutions since April 2024. CERT Polska has specifically analyzed the NGate malware campaign, which employs NFC relay attacks to enable unauthorized ATM withdrawals using victims’ own payment cards. Victims are lured through phishing messages and social engineering phone calls, convincing them to install a malicious Android app and verify their payment card by tapping it against their phone and entering their PIN. The app captures the NFC exchanges and PIN, relaying this data to an attacker-controlled device at an ATM, allowing criminals to withdraw cash without physical access to the card. The malware registers itself as an HCE payment service and conceals its C2 infrastructure within encrypted assets, complicating detection and response efforts.
Jul 12, 2026