NGate:Novel Android malware for unauthorized ATM withdrawals via NFC relay
summary
NGate is Android malware that steals bank PINs via phishing then performs a live NFC relay to cash out ATMs; researchers find six samples all signed with one certificate and targeting clients of three banks in Czechia. Distribution uses malicious PWAs, WebAPKs and native APKs to harvest credentials, while the relay reuses the open source NFC-Gate tool, uses two C2 servers, requires simultaneous card session and successfully enabled real withdrawals before arrests halted the campaign.
AI-written summary · about
chapters (9)
- 0:00NGate malware discovery
- 2:11NGate malware overview
- 5:13NGate attack scenario
- 8:32Technical analysis of NGate
- 12:11NGate features and NFC relay
- 15:05NFC Gate tool role
- 17:55NFC Gate attack scenarios
- 23:25Campaign summary and prevention
- 25:35Security recommendations & Q&A
related talks
18mNFCGate: Opening the Door for NFC Security Research with a Smartphone-Based Toolkit
57m(In)Security of Mobile Banking
30m"Latest Android threats and their techniques"
33mHacking Next-Gen ATMs: From Capture to Cashout
51mMoney Doesn't Stink - Cybercriminal Business Insight of A New Android Botnet
24mRecent Mobile App Security Incidents from Real-World Cases
42mThe Ways Hackers Are Taking To Win The Mobile Malware Battle
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs