New payment-card scam involves a phone call, some malware and a personal tap

Cleafy describes an active scam in Italy where attackers use phishing SMS and social engineering to trick Android users into installing SuperCard X malware, then instruct victims to place their physical payment card near the infected phone so the malware can silently capture NFC-transmitted card details. The operation, overlapping with prior NGate activity and likely offered as malware-as-a-service by Chinese-speaking actors, enables near-instant theft of funds and may be replicable in other regions.