Group-IB’s research reveals Chinese cybercriminals using NFC-enabled Android malware to relay tap-to-pay transactions remotely. The “Ghost Tap” malware uses a two-component architecture: a reader app on the victim’s device collects payment data, then relays it through attacker-controlled servers to a tapper app that transmits the data to real POS terminals, making the transaction appear as if the attacker’s phone were the victim’s physical bank card. ThreatFabric described the “Ghost Tap” tactic back in November 2024, when fraudsters relayed stolen cards linked to Google Pay or Apple Pay to money mules standing at store terminals. Vendors like TX-NFC (21,000+ Telegram subscribers) sell subscriptions from $45/day to $1,050 for three months, with at least $355,000 in documented fraudulent transactions between November 2024 and August 2025. Arrests have already been made in the US, Singapore, and the Czech Republic. The Czech case traces back to NGate, which ESET documented in August 2024 abusing the relay function of NFCGate, a research tool from TU Darmstadt, to withdraw victims’ money at ATMs.
Ghost Tapped: NFC Relay Fraud Goes Mobile
··1 min