Chinese Hackers Deploy NFC-enabled Android Malware to Steal Payment Data

Chinese threat actors are operating a Ghost Tap campaign that distributes NFC-enabled Android malware via messaging platforms and fake apps to trick users into granting NFC permissions; once installed the malware silently reads payment card data when victims tap cards to infected devices, persists by registering as a system service and hooking Android’s NFC framework, and exfiltrates stolen data to attacker-controlled servers—researchers tracked over 54 samples and victims across multiple countries have reported financial losses.