New “Ghost Tap” Attack Hijacks Android Phones to Drain Bank Accounts

Group-IB researchers uncovered the “Ghost Tap” ecosystem: NFC-enabled Android malware (reader+tapper apps) that captures ISO 14443 contactless card data and relays it via WebSocket C2 to attackers who cash out using fraudulent POS terminals and mule networks. The investigation identified 54+ APK samples, commercial malware vendors (TX-NFC, X-NFC, NFU Pay) selling subscriptions and custom builds, use of packers (360 Jiagu), reuse of NFCProxy code, at least $355,000 in fraudulent transactions tied to one operation, and multiple arrests across several countries.