Loading story…
Group-IB reported on Ghost Tapped, an Android malware operation tied to Chinese-speaking threat actors that abuses NFC capabilities to facilitate fraudulent tap-to-pay transactions. The malware is designed to compromise Android devices and misuse payment card data on infected phones, allowing attackers to support in-person payment fraud through contactless transaction mechanisms.
The report tracks the growth of the campaign and highlights how mobile malware is evolving beyond credential theft and banking overlays into direct abuse of tap-to-pay functionality. The activity underscores a broader risk to financial institutions, merchants, and Android users as attackers increasingly weaponize legitimate mobile payment features to conduct fraud at scale.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Group-IB published a blog post titled "Ghost Tapped: Tracking the Rise of Chinese Tap-to-pay Android Malware," disclosing research into the rise of a Chinese Android malware threat focused on tap-to-pay abuse.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified a surge in Android malware abusing Near-Field Communication (NFC) and Host Card Emulation (HCE) to steal payment data and facilitate unauthorized transactions. Over 760 malicious apps have been discovered targeting banks, payment services, and government portals worldwide, including institutions in Russia, Europe, and Brazil. These apps often impersonate trusted organizations, urging users to set them as default NFC payment handlers, and exfiltrate sensitive EMV card data—such as device IDs, card numbers, and expiry dates—via Telegram channels. Attackers remotely control the apps through command-and-control servers, enabling them to relay card terminal requests, provide PINs, and execute fraudulent transactions with minimal user interaction. The rapid adoption of "Tap-to-Pay" has made NFC a lucrative target, with over 70 C2 servers and dozens of Telegram bots coordinating attacks against more than 20 global institutions since April 2024. CERT Polska has specifically analyzed the NGate malware campaign, which employs NFC relay attacks to enable unauthorized ATM withdrawals using victims’ own payment cards. Victims are lured through phishing messages and social engineering phone calls, convincing them to install a malicious Android app and verify their payment card by tapping it against their phone and entering their PIN. The app captures the NFC exchanges and PIN, relaying this data to an attacker-controlled device at an ATM, allowing criminals to withdraw cash without physical access to the card. The malware registers itself as an HCE payment service and conceals its C2 infrastructure within encrypted assets, complicating detection and response efforts.
Jul 12, 2026
Researchers and incident responders reported that the **Smishing Triad** is pairing large-scale SMS phishing with **NFC relay** fraud to monetize stolen payment cards. In Slovakia, attackers impersonated health insurer **VšZP** in fraudulent text messages that led victims to phishing domains including `informacie-poistenca[.]com` and `obnovypoistenca[.]com`, where they were prompted to submit personal data, card details, and one-time passwords. CSIRT.SK said the malicious infrastructure was identified in February 2025 and linked the campaign to reusable phishing kits and hosting associated with other suspicious domains. The stolen card data is then reportedly provisioned into **Apple Pay** or **Google Pay** wallets and used in a cash-out method known as **Ghost Tap**, which relays NFC payment transactions to enable fraudulent contactless purchases. ThreatFabric described Ghost Tap as an emerging tactic in which criminals combine wallet provisioning, relay tooling, and malware such as **ZNFC** to bypass the need for a physical card. Investigators also cited Chinese-language traces and Telegram activity tied to the alias **`wangduoyu8`**, reinforcing attribution links between the phishing operations and the broader China-linked smishing ecosystem.
Jul 24, 2026
Security researchers have identified a surge in Android malware that abuses Near Field Communication (NFC) and Host Card Emulation (HCE) features to steal payment data and conduct fraudulent transactions. Since April 2024, over 760 malicious apps have been detected, with campaigns expanding from isolated incidents to a global threat affecting users in Russia, Poland, the Czech Republic, Slovakia, Brazil, and other countries. These apps impersonate trusted financial institutions and government services, including the Central Bank of Russia, Gosuslugi, Santander, and VTB Bank, to deceive users into installing them and setting them as the default payment method. Once installed, the malware activates NFC relay functionality, capturing card data in real time and forwarding it to attacker-controlled servers. The operation is coordinated through more than 70 command-and-control servers and numerous Telegram bots, enabling attackers to use one infected device to collect payment data and another to complete fraudulent transactions at physical terminals. The rapid proliferation and sophistication of these attacks highlight the growing risk to mobile payment systems and the need for increased vigilance among Android users and financial institutions.
Jul 12, 2026