Loading story…
Researchers and incident responders reported that the Smishing Triad is pairing large-scale SMS phishing with NFC relay fraud to monetize stolen payment cards. In Slovakia, attackers impersonated health insurer VšZP in fraudulent text messages that led victims to phishing domains including informacie-poistenca[.]com and obnovypoistenca[.]com, where they were prompted to submit personal data, card details, and one-time passwords. CSIRT.SK said the malicious infrastructure was identified in February 2025 and linked the campaign to reusable phishing kits and hosting associated with other suspicious domains.
The stolen card data is then reportedly provisioned into Apple Pay or Google Pay wallets and used in a cash-out method known as Ghost Tap, which relays NFC payment transactions to enable fraudulent contactless purchases. ThreatFabric described Ghost Tap as an emerging tactic in which criminals combine wallet provisioning, relay tooling, and malware such as ZNFC to bypass the need for a physical card. Investigators also cited Chinese-language traces and Telegram activity tied to the alias wangduoyu8, reinforcing attribution links between the phishing operations and the broader China-linked smishing ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK published analysis connecting the Slovakia-focused VšZP impersonation campaign to the broader China-linked Smishing Triad, citing reusable phishing kits, infrastructure overlaps, and monetization via Apple Pay or Google Pay and Ghost Tap-style NFC relay. The report also referenced prior reverse engineering that found Chinese-language traces and Telegram activity tied to the alias "wangduoyu8."
CSIRT.SK reported identifying the malicious domains informacie-poistenca[.]com and obnovypoistenca[.]com used in a smishing campaign impersonating Všeobecná zdravotná poisťovňa (VšZP). The campaign directed victims to phishing sites to steal personal data, payment-card details, and OTPs.
ThreatFabric published research describing Ghost Tap as a cash-out technique that uses NFC relay to enable fraudulent contactless payments with card data provisioned into mobile wallets.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 77 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB reported on **Ghost Tapped**, an Android malware operation tied to Chinese-speaking threat actors that abuses **NFC** capabilities to facilitate fraudulent tap-to-pay transactions. The malware is designed to compromise Android devices and misuse payment card data on infected phones, allowing attackers to support in-person payment fraud through contactless transaction mechanisms. The report tracks the growth of the campaign and highlights how mobile malware is evolving beyond credential theft and banking overlays into direct abuse of **tap-to-pay** functionality. The activity underscores a broader risk to financial institutions, merchants, and Android users as attackers increasingly weaponize legitimate mobile payment features to conduct fraud at scale.
Jul 12, 2026
Researchers have identified a surge in Android malware abusing Near-Field Communication (NFC) and Host Card Emulation (HCE) to steal payment data and facilitate unauthorized transactions. Over 760 malicious apps have been discovered targeting banks, payment services, and government portals worldwide, including institutions in Russia, Europe, and Brazil. These apps often impersonate trusted organizations, urging users to set them as default NFC payment handlers, and exfiltrate sensitive EMV card data—such as device IDs, card numbers, and expiry dates—via Telegram channels. Attackers remotely control the apps through command-and-control servers, enabling them to relay card terminal requests, provide PINs, and execute fraudulent transactions with minimal user interaction. The rapid adoption of "Tap-to-Pay" has made NFC a lucrative target, with over 70 C2 servers and dozens of Telegram bots coordinating attacks against more than 20 global institutions since April 2024. CERT Polska has specifically analyzed the NGate malware campaign, which employs NFC relay attacks to enable unauthorized ATM withdrawals using victims’ own payment cards. Victims are lured through phishing messages and social engineering phone calls, convincing them to install a malicious Android app and verify their payment card by tapping it against their phone and entering their PIN. The app captures the NFC exchanges and PIN, relaying this data to an attacker-controlled device at an ATM, allowing criminals to withdraw cash without physical access to the card. The malware registers itself as an HCE payment service and conceals its C2 infrastructure within encrypted assets, complicating detection and response efforts.
Jul 12, 2026
A newly identified Android fraud campaign is using the **SpyNote** remote-access trojan alongside a previously unseen NFC relay malware family called **WindRelay** to steal funds from bank customers in minutes. Group-IB said attackers impersonated bank employees in live phone calls, persuaded victims in **Czechia, Slovakia, and Slovenia** to sideload a malicious app, and abused Android Accessibility features to take control of the device and the victim’s banking app. In one investigated case, the criminals issued a loan in the victim’s name and began fraudulent activity within **13 minutes**. After gaining access, the attackers remotely installed WindRelay and instructed the victim to tap their physical payment card against the phone. The malware captured live NFC card data and a one-time transaction code, then relayed the exchange in real time to a second attacker-controlled device used at a legitimate payment terminal, enabling fraudulent **card-present** purchases without relying on stolen static card details. Group-IB linked the activity to 23 VirusTotal samples uploaded between November 2025 and July 2026 and said the operation shows how social engineering, sideloaded apps, and live NFC relaying can accelerate account takeover and payment fraud while evading ordinary checks.
Aug 20, 2026