New Android Malware Draining Bank Accounts
- A new form of Android malware, dubbed Supercard X, is targeting smartphone users through Near Field Communication (NFC) technology to steal banking data and make fraudulent payments, cybersecurity...
- Supercard X operates as a Malware-as-a-Service (MaaS) platform, offering cybercriminals ready-made tools for illicit activities.
- The malware appears to draw inspiration from open-source tools like NFCGATE and its malicious variant,Ngate,which saw use in Europe last year,according to cleafy.
Supercard X Malware Targets Android users via NFC, Banking Data Theft
Table of Contents
- Supercard X Malware Targets Android users via NFC, Banking Data Theft
- Supercard X Malware: Your Questions Answered
- What is Supercard X Malware?
- How Does Supercard X Work?
- Who is Behind Supercard X? Is it a Refined Threat?
- What is “Malware-as-a-Service” (MaaS)?
- What Permissions Does the “Reader” App Request?
- How Does Supercard X Steal My Card Data via NFC?
- Can Supercard X Make Contactless Payments?
- Is It Possible to Withdraw Cash from ATMs with Supercard X?
- How Does Supercard X Evade Detection from Antivirus Software?
- Is Supercard X Detected by Antivirus software?
- What’s Google’s Position on Supercard X Malware?
- How Does Google Play Protect Protect Android Users Against Malware like Supercard X?
- How Can I Protect Myself from Supercard X and Similar Threats?
A new form of Android malware, dubbed Supercard X, is targeting smartphone users through Near Field Communication (NFC) technology to steal banking data and make fraudulent payments, cybersecurity researchers warn.
Malware-as-a-Service Platform Emerges
Supercard X operates as a Malware-as-a-Service (MaaS) platform, offering cybercriminals ready-made tools for illicit activities. Researchers at Cleafy, a cybersecurity firm, first identified the malware’s activity in Italy. They report that Supercard X is being advertised on Telegram channels, complete with customer support for paying users.
The malware appears to draw inspiration from open-source tools like NFCGATE and its malicious variant,Ngate,which saw use in Europe last year,according to cleafy.
The attack sequence begins with a phishing SMS or WhatsApp message, purportedly from the victim’s bank. Upon calling the provided number, the victim is connected to a fraudulent advisor who uses social engineering tactics to extract their card number and PIN. The criminals then persuade the victim to lift spending limits on their banking application.
The “Reader” App: A Trojan Horse
The final step involves tricking the victim into installing a malicious application disguised as a security tool called “Reader.” This app requests minimal permissions, primarily access to the NFC module, allowing it to evade detection.
Once installed, the “Reader” app prompts the user to scan their bank card against their phone for “verification.” In reality, the app extracts the card’s chip data and transmits it to the attackers. The criminals then use this data on another Android device running a second application, “Tap,” which emulates a bank card.
Contactless Payments and ATM Withdrawals
This process enables attackers to make contactless payments at businesses or withdraw cash from ATMs, within the card’s spending limits. These transactions are difficult for banks to detect because they occur rapidly and appear legitimate.
Supercard X Evades Detection
Cleafy reports that Supercard X remains undetected by antivirus software, including those on Virustotal. Its stealth is enhanced by the limited permissions it requests and the use of Mutual TLS (MTLS) encryption, which complicates the interception of communications between infected devices and control servers.
Google’s Response
Google, when asked about the malware, stated that “No application containing this malware was detected on Google Play.” The company also highlighted its Play Protect system, which provides default protection for Android users, even against externally installed applications.
Supercard X Malware: Your Questions Answered
Here’s a breakdown of the Supercard X Android malware, designed to help you understand the threat and protect yourself.
What is Supercard X Malware?
Supercard X is a new type of Android malware that targets smartphone users to steal banking data and make fraudulent payments. It leverages Near Field Dialogue (NFC) technology for its malicious activities. Cybersecurity researchers have identified and are tracking its activity, particularly.
How Does Supercard X Work?
Supercard X operates through a multi-stage process involving social engineering and the exploitation of NFC technology.
Here’s the typical attack flow:
- Phishing: The attack often begins with a phishing SMS or WhatsApp message that seems to come from the victim’s bank.
- Social Engineering: The victim is tricked into calling a fraudulent number provided in the message and is then connected to a fake “advisor.” This “advisor” uses social engineering tactics to obtain the victim’s card number, PIN, and persuades them to increase their spending limits.
- Trojan Horse App Installation: The victim is convinced to install a malicious application called “Reader”, disguised as a security tool.
- Data Extraction: The “Reader” app,after installation,requests minimal permissions (primarily NFC access). This allows it to extract card data when the user “scans” their bank card against their phone for “verification.”
- Fraudulent Transactions: Attackers then use the stolen card data on another Android device running a second application, “Tap”, to make contactless payments or ATM withdrawals.
Who is Behind Supercard X? Is it a Refined Threat?
Supercard X is distributed through a “Malware-as-a-Service” model (MaaS). This means cybercriminals can purchase ready-made tools to conduct these attacks through various online platforms, like Telegram. This makes the malware accessible to a wider range of individuals, even with limited technical skills. The use of techniques from open-source projects like NFCGATE suggest an evolving and actively developed threat.
What is “Malware-as-a-Service” (MaaS)?
MaaS provides cybercriminals with pre-built malware and infrastructure, allowing them to launch attacks without needing extensive technical skills. It lowers the barrier to entry for malicious activities.
What Permissions Does the “Reader” App Request?
The “Reader” app attempts to evade detection by requesting minimal permissions, primarily access to the NFC module.This helps it to operate covertly.
How Does Supercard X Steal My Card Data via NFC?
The malware abuses NFC technology in a clever way.
- The “Reader” app prompts the user to scan their bank card against their phone.
- When a card is scanned, the app quietly extracts sensitive chip data from the card (this process is done without requiring the user to input critical information).
- The stolen data is then transmitted for further use by the attackers.
Can Supercard X Make Contactless Payments?
Yes, Supercard X can be used to make contactless payments at businesses within spending limits. The data stolen from the infected device is eventually used on another device to mimic a bank card, allowing for fraudulent transactions.
Is It Possible to Withdraw Cash from ATMs with Supercard X?
Yes. The malware allows fraudsters to use the stolen financial data to withdraw cash from ATMs, again, within the stolen card’s spending limits set by the issuing bank. This further highlights the financial risk.
How Does Supercard X Evade Detection from Antivirus Software?
Supercard X is designed to be stealthy. It uses several techniques to avoid detection:
Limited Permissions: Requests minimal permissions on the infected device, reducing red flags for security software.
Mutual TLS (MTLS) Encryption: Uses secure encryption to protect communication between the infected device and the control servers, making it hard for security systems to detect its activities.
Is Supercard X Detected by Antivirus software?
According to Cleafy, Supercard X remains undetected by antivirus software, including those available on Virustotal at the time of their research and reporting.
What’s Google’s Position on Supercard X Malware?
Google stated that no application containing this malware was detected on Google Play. They also emphasized their Play Protect system, which provides default protection for Android users.
How Does Google Play Protect Protect Android Users Against Malware like Supercard X?
Google Play Protect automatically scans apps on your device and from the Google Play store, providing a layer of defense.It can detect and block apps known to be malicious, safeguarding users from threats. Though, the malware’s ability to be side-loaded means using caution with applications from outside the Play Store is a must!
How Can I Protect Myself from Supercard X and Similar Threats?
Here are some critically importent tips to protect yourself:
Be Suspicious of Unsolicited Messages: Don’t trust SMS or WhatsApp messages claiming to be from your bank, especially if they ask for personal information.
Verify Official Communications: If you receive a suspicious message, contact your bank directly through a verified phone number or website.
Never Share Sensitive Information: never give out your card number, PIN, or other banking details to unsolicited callers or through unverified websites or apps.
Be Careful with App Downloads: Only download apps from trusted sources, like the Google Play Store. Check the app’s reviews, permissions, and developer information before installing.
Keep Your Software Updated: Keep your Android device’s operating system and apps up-to-date to patch security vulnerabilities.
Use a Strong Password Manager: It can help to maintain unique,complex passwords for all of your online accounts,including banking and critical applications.
Monitor Your Bank Accounts: Regularly review your bank statements and transaction history for any unauthorized activity.
Consider a Security App: Install a reputable mobile security app to provide an additional layer of protection against malware.
Summary of Supercard X Attack Methods
| Attack Method | Description |
| ———————- | ——————————————————————————————————————————————————————— |
| Phishing SMS/WhatsApp | Tricking victims into providing their card details via malicious messages. |
| Social Engineering | Fraudulent advisors manipulating victims to disclose banking card and PIN information. |
| “Reader” App | Malicious app, disguised as a security tool, to steal card data through NFC scanning. |
| Contactless Payments | Using stolen card data to make fraudulent contactless payments at businesses. |
| ATM Withdrawals | Using the stolen data to withdraw cash from ATMs within the victim’s spending limits. |
| MaaS Platform | Distribution as a readily available “Malware-as-a-Service” so that cybercriminals can easily launch attacks. |
| Evading Detection | using MTLS encryption, and minimal permission requests to avoid detection by anti-virus and system security software to avoid triggering early warning systems. |
By understanding the threat and taking these precautions, you can considerably reduce your risk of falling victim to Supercard X or similar attacks.