NGate Android Malware Steals NFC Payment Data at ATMs

ESET researchers uncovered a campaign in the Czech Republic using a novel Android malware named NGate that relays NFC payment card data from victims’ devices to attackers, enabling ATM cash withdrawals without requiring device rooting; the campaign combined phishing via Progressive Web Apps/WebAPK with an NFC relay tool (NFCGate) and was active from November 2023 until arrests in March 2024 reduced activity.