New Android Malware NGate Exploits NFC to Steal Card Data and Drain Bank Accounts

A sophisticated new Android malware dubbed NGate has been discovered that exploits near-field communication (NFC) technology to steal payment card data and potentially drain victims' bank accounts. This malware highlights the evolving tactics of cybercriminals in targeting mobile payment systems.

How NGate Works

NGate, named after the NFCGate toolkit it utilizes, operates through a multi-step attack:

1. Victims receive urgent text messages with links to fake websites, often impersonating tax authorities or banks.
2. These sites collect login credentials, giving attackers access to victims' accounts.
3. Attackers then call victims, posing as bank employees, and instruct them to install a security app - actually the NGate malware.
4. The malware prompts victims to enable NFC and scan their payment cards.
5. Card data is relayed in real-time to the attacker's device, which can then emulate the card at ATMs or point-of-sale terminals.

Scope and Origin

• Discovered by cybersecurity firm ESET
• At least six malicious apps spreading NGate identified between November 2022 and March 2023
• Initially targeting banks in the Czech Republic
• No infected apps found on the Google Play Store

Protecting Yourself

To avoid falling victim to NGate and similar threats:

• Only download apps from official stores like Google Play
• Be wary of unsolicited messages urging app installations
• Never share sensitive financial information via unfamiliar apps or websites
• Verify requests for information by contacting companies through official channels
• Consider disabling NFC when not in use
• Ensure Google Play Protect is enabled on your device

Ensuring security in mobile payments and protecting against malware threats

Google's Response

Google has stated that Android users are protected against known versions of NGate by Google Play Protect, which can warn about or block malicious apps even from third-party sources.

As mobile payment technologies continue to evolve, it's crucial for users to remain vigilant and for security measures to keep pace with emerging threats like NGate.

Awareness of mobile payment security threats is crucial for Android users