Full Report
Group-IB researchers detail the inner workings of Chinese tap-to-pay schemes on Telegram and examine the NFC-enabled Android apps fraudsters are using to steal money from victim’s bank cards and mobile wallets remotely.
Analysis Summary
# Tool/Technique: NFC Android Malware (Tap-to-Pay Fraud)
## Overview
Group-IB has identified a sophisticated Chinese-language fraud scheme utilizing specialized Android malware designed to intercept and relay Near Field Communication (NFC) data. The primary purpose is to steal credit card information and mobile wallet data remotely, allowing attackers to perform unauthorized "tap-to-pay" transactions at physical Point-of-Sale (POS) terminals using the victim’s relayed credentials.
## Technical Details
- **Type:** Malware Family (Android Trojan/NFC Relay Tool)
- **Platform:** Android
- **Capabilities:** NFC data capture, real-time relay of payment credentials, SMS interception (for 2FA bypass), and screen recording.
- **First Seen:** Approximately 2023/2024 (Active campaigns identified in 2024)
## MITRE ATT&CK Mapping
- **[TA0030 - Execution]**
- [T1204.001 - User Execution: Malicious Link]
- **[TA0035 - Collection]**
- [T1430 - Access Contact List]
- [T1512 - Screen Capture]
- **[TA0037 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
- **[TA0032 - Credential Access]**
- [T1641 - Exploitation for Credential Access (NFC Relay)]
- **[TA0038 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **NFC Relaying:** The malware acts as a proxy, capturing NFC signals from a victim's physical bank card or mobile device and transmitting that data to an attacker-controlled device.
- **Payment Interception:** Allows attackers to use their own NFC-enabled phones to "impersonate" the victim's card at a store terminal in real-time.
- **SMS Redirection:** Intercepts incoming SMS messages, enabling attackers to capture one-time passwords (OTPs) and bypass two-factor authentication.
### Advanced Features
- **Telegram C2 Integration:** Fraudsters manage the infected devices and relay sessions through specialized Telegram bots and channels.
- **Social Engineering Kits:** The malware is often bundled or distributed via "phishing-as-a-service" kits targeting Chinese-speaking users.
- **Permission Abuse:** Requests high-level Android permissions (Accessibility Services) to maintain persistence and record screen activity.
## Indicators of Compromise
### File Hashes (SHA256)
*Note: Representative samples based on report data*
- `9a9631ab469600514fd0bd30fe34a6daf90ca58bcf5bde5a872218422aeea7c6`
- `138d417d48677c8ddb6b9371b7f792272c99f996a15e0b79bef8aacdb2ca1445`
- `b31177a046ddaa4822e137c0c91a15cc250de285dcac534724cc61262397ebde`
- `fc2c8cd05ef53d21b1c64dd9f9b826e996a2a2931b5d1f7a00d210a40d48deac`
- `282712a57768b1bc4cea5764e0b045546f281a4da0fd58d346f09499f892ba7a`
### Network Indicators
- `nfc[.]rc8820[.]com`
- `xxnfc[.]com`
- `txnfc[.]com`
- `apk[.]nfu20251021[.]win`
- `app[.]nfu1010[.]com`
### Behavioral Indicators
- Requesting `android.permission.NFC` and `android.permission.BIND_ACCESSIBILITY_SERVICE` simultaneously.
- Unusual outgoing traffic to Telegram API domains (`api[.]telegram[.]org`).
- Background processes named after common system apps or payment utilities.
## Associated Threat Actors
- **Chinese-speaking Fraud Groups:** Currently linked to underground "Tap-to-Pay" service providers operating on Telegram targeting global banking users.
## Detection Methods
- **Signature-based:** Standard AV engines can detect the specific APK signatures provided in the IoC list.
- **Behavioral:** Monitoring for apps that request NFC permissions but lack a legitimate financial service UI, or apps that frequently access SMS and NFC data in the background.
- **YARA Rule Hint:** Look for strings related to `NfcAdapter`, `IsoDep`, and specific Chinese C2 commands in the manifest and classes.dex.
## Mitigation Strategies
- **User Education:** Warn users against downloading APKs from third-party sources (Telegram, unofficial websites).
- **Device Hardening:** Disable NFC when not in use.
- **Permission Management:** Review and revoke "Accessibility Service" permissions for suspicious or unknown applications.
- **Platform Protection:** Use Google Play Protect and reputable mobile security solutions.
## Related Tools/Techniques
- **NGate:** A similar Android malware family used for NFC relaying.
- **Card-Not-Present (CNP) Fraud:** While this involves a physical terminal, the backend data theft aligns with CNP techniques.
- **SMS Stealers:** General malware class used to bypass 2FA.