“Ghost Tap” Rising: New Wave of Android Malware Turns Phones into Digital Pickpockets

According to Group-IB, a new underground market for NFC-enabled Android malware is spreading globally, with Chinese threat actors selling tools to conduct unauthorized tap-to-pay transactions remotely. Dubbed “Ghost Tap” by researchers, the malware relays Near Field Communication signals over the internet to bridge a victim’s card and a thief’s POS terminal.

The operation typically uses two Android apps, the Reader on the victim’s device and the Tapper on the criminal’s device, to simulate the card when near a payment terminal. Group-IB identified multiple vendors promoting these tools on Telegram, including TX-NFC, X-NFC, and NFU Pay, with over 54 distinct APK samples noted and some vendors offering 24/7 customer support.

The investigation recorded at least $355,000 in illegitimate transactions from a single group, Oedipus, between November 2024 and August 2025, highlighting the evolving blend of digital fraud and physical theft.