NGate Malware Enables Unauthorized Cash Withdrawals at ATMs Using Victims’ Payment Cards

NGate is described as an Android-based threat that exploits near-field communications to enable unauthorized ATM cash withdrawals using victims’ payment cards, without stealing the physical card. The malware uses a relay attack whereby NFC communications from a victim’s phone are transmitted to an attacker’s device at an ATM, allowing fraudulent transactions to bypass standard security checks.

The campaign leverages social engineering, including phishing emails or SMS claiming technical problems and impersonations of bank staff, to persuade victims to install malicious APKs distributed via file-hosting services. Once installed, the app prompts users to verify their card within the app, requiring the card to be held to the phone’s NFC reader and the PIN entered on-screen, after which the malware captures NFC data and the PIN for replay at an ATM.

IOCs include the C2 endpoint at 91.84.97[.]13:5653, several MD5 hashes (2cee3f603679ed7e5f881588b2e78ddc, 701e6905e1adf78e6c59ceedd93077f3, 2cb20971a972055187a5d4ddb4668cc2, b0a5051df9db33b8a1ffa71742d4cb09, bcafd5c19ffa0e963143d068c8efda92) and the URL files[.]fm/u/yfwsanu886. Researchers note the C2 conversations are transmitted in plaintext TCP, lacking TLS encryption.

The campaign also stresses that banking apps should be downloaded only from official stores, and users should verify callers independently by contacting their bank through official channels.