Ghost Tap Malware Fuels Surge in Remote NFC Payment Fraud

Group-IB researchers have documented a wave of Android tap-to-pay malware sold and promoted via Chinese-language Telegram cybercrime communities that remotely relays NFC card data from victims’ phones to complete fraudulent contactless transactions; researchers identified over 54 malicious APKs, named vendor groups (e.g., TX-NFC, X-NFC, NFU Pay), described smishing/vishing delivery methods, C2-enabled relaying and mule/mobile wallet cash-outs across multiple countries, and linked at least $355,000 in illegitimate transactions to one POS terminal vendor.