NGate NFC Malware Steals Cash from ATMs by Relaying EMV Data and PINs from Victim’s Phone

CERT Polska has uncovered a new Android-based NFC relay malware, dubbed NGate, that enables criminals to withdraw cash from ATMs using victims’ own payment cards without stealing the card itself. According to CERT Polska, the campaign is designed to enable unauthorized cash withdrawals at ATMs using victims’ own payment cards, with criminals relaying the card’s NFC traffic from the victim’s Android phone to a device the attacker controls at an ATM.

The attack starts with a phishing and social engineering effort that impersonates bank staff, steering victims to install a malicious Android app after receiving fake security alerts. Once installed, the malware registers as an Android Host Card Emulation payment service, allowing it to act as a virtual card and to relay EMV data and PINs in real time between the victim’s device and the attacker’s ATM relay terminal.

The malware also extracts card data such as PAN, expiration date and AID, files a binary structure with the PIN, and sends them to the attacker over an unencrypted TCP connection to the C2 server at 91.84.97[.]13:5653. It maintains a persistent connection with keepalive pings every seven seconds, enabling the attacker to complete a transaction session without the need for a physical card. November 5, 2025.