“This is the first time we have seen Android malware with this capability being used in the wild.”
NGate relayed the NFC data from a victim’s bank card to an attacker’s rooted phone, which then pulled cash from ATMs. Clients of three Czech banks were hit between November 2023 and March 2024. Victims never had to root anything and the app never touched Google Play. Czech police caught one 22-year-old in Prague with 160,000 korunas, which is about 6,000 euros. Tap-to-pay convenience works just as well for the thief standing at the ATM.