PhantomCard Android Trojan Relays Brazilian Users’ Bank Card Data Over NFC
Summary
ThreatFabric describes PhantomCard, an Android Trojan distributed through fake card-protection app pages in Brazil. It relays EMV card data and PINs to enable remote payment or ATM fraud, and is reportedly a customized NFU Pay malware-as-a-service product.
Key points
- PhantomCard masquerades as a “Card Protection” app and is distributed through fake Google Play pages with fabricated positive reviews.
- The app prompts victims to tap a physical card against their phone, then captures NFC data and asks for the card PIN.
- It targets EMV contactless cards using ISO-DEP and relays card data through a criminal-controlled server to a fraudster’s device near a POS terminal or ATM.
- ThreatFabric attributes the campaign to the “Go1ano developer,” described as a reseller who customized an NFU Pay malware-as-a-service product for Brazil.
- The researchers warn that the service’s customizability and claims of global operation could enable similar campaigns in other regions.
- ThreatFabric advises financial organizations to monitor NFC-relay threats and educate users not to install apps that ask them to tap a card to verify or protect it.
Article Details
- Attack Vectors
- PhantomCard is distributed to Brazilian users through fake Google Play pages posing as the “Proteção Cartões” card-protection app.
- The app prompts victims to tap a payment card against an infected Android phone, relays NFC data to a criminal-controlled server, and asks the victim for a card PIN.
- A criminal/mule-side application relays the victim-side card communication to a nearby POS terminal or ATM, enabling transactions using the victim’s physical card.
- Defensive Notes
- Financial organizations are advised to monitor threats such as PhantomCard and NFSkate and raise user awareness about suspicious apps that ask users to tap a card to verify or protect it.
- The article notes that transaction monitoring may not readily identify this fraud because transactions can appear to use the victim’s physical card and PIN; unusual transaction metadata, such as merchant or location, may help reveal it.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | a78ab0c38fc97406727e48f0eb5a803b1edb9da4a39e613f013b3c5b4736262f | SHA-256 hash listed in the article’s indicators of compromise for the PhantomCard campaign. |
| SHA256 | cb10953f39723427d697d06550fae2a330d7fff8fc42e034821e4a4c55f5a667 | SHA-256 hash listed in the article’s indicators of compromise for PhantomCard. |
MITRE ATT&CK
T1412PhantomCard requests the victim’s card PIN and relays it to the fraudster for transaction authentication.T1437The Android malware communicates NFC card data to a criminal-controlled relay server.T1476PhantomCard is distributed through fake Google Play pages masquerading as a card-protection app.
Threat Actors
Malware
BTMOBBesides PhantomCard, "Go1ano developer" also claims to be the "trusted partner" of BTMOB, GhostSpy spyware families in Brazil.Ghost TapGhost Tap became another milestone on the evolution of NFC-based attacks, where cybercriminals are using NFC relay for cash-out purposes.GhostSpyBesides PhantomCard, "Go1ano developer" also claims to be the "trusted partner" of BTMOB, GhostSpy spyware families in Brazil.KingNFC"NFU Pay" is one of the several services available on the underground market similar to SuperCardX, KingNFC, X/Z/TX-NFC, etc.NFSkateOur Mobile Threat Intelligence service is monitoring NFC-relay threats and tactics since the discovery of NFSkate (aka NGate) in March 2024.NGateOur Mobile Threat Intelligence service is monitoring NFC-relay threats and tactics since the discovery of NFSkate (aka NGate) in March 2024.PhantomCardIn this report we introduce PhantomCard - a new Android NFC-based Trojan targeting banking customers in Brazil and potentially expanding globally.RocinanteThe name "PegasusSpy" already popped up in our research of Rocinante - another Trojan targeting users from Brazil (and not to be confused with Pegasus spyware).SuperCardX"NFU Pay" is one of the several services available on the underground market similar to SuperCardX, KingNFC, X/Z/TX-NFC, etc.X/Z/TX-NFC"NFU Pay" is one of the several services available on the underground market similar to SuperCardX, KingNFC, X/Z/TX-NFC, etc.
Tools
NFCGateUnlike the generic implementation of NFCGate research project (that became the starting point for the NFC attacks and the base for NFSkate), where lots of different NFC tags are supported, PhantomCard’s implementationNFU PaySource code reveals lots of debug messages in Chinese as well as package name referring to "NFU Pay" Malware-as-a-Service promoted on Telegram:scuba_smartcardsPhantomCard relies on “scuba_smartcards” library to parse the send and receive data from the card.