New NGate Android malware uses NFC chip to steal credit card data

A new Android malware called NGate has emerged, capable of stealing credit card data through the near-field communication (NFC) chip. This malware allows attackers to emulate victims' cards, enabling unauthorized payments and cash withdrawals from ATMs. Active since November 2023, NGate is linked to a campaign that exploits progressive web apps (PWAs) and advanced WebAPKs to deceive users into providing banking credentials. The attack typically begins with malicious texts or calls, prompting victims to install a malicious PWA disguised as a security update. Once installed, NGate utilizes an open-source component named 'NFCGate' to capture NFC data from nearby payment cards and relay it to the attacker. The malware can also clone NFC access cards and tokens. To obtain the card's PIN, attackers employ social engineering tactics, posing as bank employees and convincing victims to verify their card details through the malware interface. The Czech police have already apprehended one individual involved in these withdrawals, highlighting the growing threat to Android users. To mitigate risks, users are advised to disable NFC when not in use, scrutinize app permissions, and only install bank apps from official sources.

- NGate malware exploits NFC technology to steal credit card data.

- Attackers use social engineering to obtain victims' PIN codes.

- The malware is linked to a campaign utilizing PWAs and WebAPKs.

- Users are advised to disable NFC and verify app sources to enhance security.

- Czech police have arrested one suspect involved in the cash withdrawal scheme.