Android malware turns phones into malicious tap-to-pay machines

SuperCard X is an Android NFC-based malware campaign that tricks victims (via smishing and phone social engineering) into installing an app which captures contactless payment card data when the victim taps their card to the infected phone; attackers receive the data and can use the attacker’s phone as a cloned card. The report notes the malware is distributed via a MaaS/affiliate model, shares code with prior projects (NGate/NFCGate), is engineered to minimize permissions to evade detection, and recommends skepticism of unsolicited messages, verifying contacts via official bank numbers, and refusing to install apps sent via text.