Loading story…
University of Massachusetts Amherst researchers disclosed a "Zombie Card" attack that can make some expired or replaced Visa contactless credit cards usable again for unauthorized purchases. The attack uses a man-in-the-middle NFC relay to alter expiration data during the EMV contactless transaction flow, exploiting the fact that in the tested Visa setup the expiration date shown to the point-of-sale terminal was not cryptographically bound to the data later used in online authorization. The researchers said this let proxy devices tamper with expiry information in transit and bypass terminal checks under certain issuer configurations.
In lab testing and limited live transactions, the technique reportedly worked against one major U.S. bank for purchases from small retail amounts up to $500, while another bank consistently rejected the same tampered transactions, indicating issuer-side controls affect exploitability. The researchers found that Mastercard, American Express, and Discover configurations resisted the attack because their implementations bind expiration data cryptographically. They disclosed the issue to Visa and affected banks in 2025, proposed fixes including cryptographic binding of expiry data and issuer validation of the specific card instance and stored expiration date, and reported that no CVE had been assigned and no confirmed mitigation had been publicly acknowledged at publication.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers from the University of Massachusetts Amherst presented the 'Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments' findings at USENIX Security 2026. They showed that certain expired or replaced Visa contactless cards could be used for unauthorized payments by modifying expiry data during NFC transactions.
The researchers sent a follow-up disclosure to Visa and affected banks regarding the same contactless payment flaw. One source says the package included a reproduction guide, transaction records, and a demonstration video.
University of Massachusetts Amherst researchers notified Visa and affected banks about the expired-card contactless payment issue, providing reproduction details and evidence. The sources state the initial disclosure occurred in May 2025.
Visa accepted the researchers' report through initial triage, and its red team was reproducing the issue. This status was reported as of the article's publication, but no explicit event date beyond that status was provided.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcetheregister.com
Open sourceumass.edu
Open sourceusenix.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical payment-processing flaw** was reportedly exploited in Spain by a 20-year-old fraudster who obtained luxury hotel stays for **€0.01** while merchants received what appeared to be legitimate payment confirmations for bookings worth **tens of thousands of euros**. The attack did not rely on stolen card numbers; instead, it allegedly **manipulated the transaction data flow** between a hotel booking site and a major payment platform so the merchant saw an approval for the full amount while the actual transferred value was only one cent. The case highlights an integrity failure in online payment validation rather than a conventional card-theft scheme. The reporting indicates the weakness stems from a **timing gap between payment authorization and final settlement**, allowing the discrepancy to remain undetected until days later, after the guest had already checked out. One account puts the direct loss at **more than €20,000** and says Spanish police identified the method as a new modus operandi. For security and fraud teams, the incident underscores the need for **real-time reconciliation** between authorized and settled amounts, stronger validation of payment notifications, and controls to ensure the amount confirmed by a processor exactly matches the amount ultimately received.
Jul 12, 2026
Researchers and incident responders reported that the **Smishing Triad** is pairing large-scale SMS phishing with **NFC relay** fraud to monetize stolen payment cards. In Slovakia, attackers impersonated health insurer **VšZP** in fraudulent text messages that led victims to phishing domains including `informacie-poistenca[.]com` and `obnovypoistenca[.]com`, where they were prompted to submit personal data, card details, and one-time passwords. CSIRT.SK said the malicious infrastructure was identified in February 2025 and linked the campaign to reusable phishing kits and hosting associated with other suspicious domains. The stolen card data is then reportedly provisioned into **Apple Pay** or **Google Pay** wallets and used in a cash-out method known as **Ghost Tap**, which relays NFC payment transactions to enable fraudulent contactless purchases. ThreatFabric described Ghost Tap as an emerging tactic in which criminals combine wallet provisioning, relay tooling, and malware such as **ZNFC** to bypass the need for a physical card. Investigators also cited Chinese-language traces and Telegram activity tied to the alias **`wangduoyu8`**, reinforcing attribution links between the phishing operations and the broader China-linked smishing ecosystem.
Jul 24, 2026
Target, Neiman Marcus, and Home Depot disclosed major payment-card breaches in which attackers planted **point-of-sale malware** on in-store checkout systems and harvested customer data at scale. Target said about **40 million** payment cards were exposed during the 2013 holiday shopping period, with later estimates rising to as many as **110 million** people affected when personal information was included. Reporting tied the Target intrusion to customized memory-scraping malware related to **BlackPOS**, which was used to collect card data from checkout terminals and stage it on internal servers before exfiltration; investigators and the U.S. Secret Service were drawn into the case as the breach became one of the largest retail compromises on record. Neiman Marcus also reported that its breach was worse than first disclosed, adding to the wave of retail intrusions. Home Depot later revealed a similarly large compromise affecting its U.S. and Canadian self-checkout systems, saying attackers stole more than **56 million** payment card numbers and over **53 million** email addresses after entering through credentials taken from a third-party vendor and moving laterally through the network. The incidents intensified pressure on U.S. retailers and payment providers to move away from vulnerable magnetic-stripe cards toward **EMV chip** technology, while also imposing steep business costs: Target reported a sharp profit decline, tens of millions of dollars in breach-related expenses, and warned that litigation, fraud losses, and investigative costs could continue to materially affect results. Together, the breaches showed how weak vendor access controls, hard-to-detect POS malware, and outdated payment technology enabled large-scale theft of card data from major retailers.
Jun 29, 2026