Android malware steals your card details and PIN to make instant ATM withdrawals

According to Malwarebytes, a new Android-based malware called NGate was analysed by the Polish Computer Emergency Response Team (CERT Polska) and documented as enabling unauthorized ATM withdrawals by stealing card details and PIN via NFC. The threat relies on infecting the victim’s phone and prompting a tap-to-pay action, after which the malware captures NFC transaction data—including the one-time codes generated for dynamic cards—and the PIN, and immediately exfiltrates it to the attackers’ servers.

With that data, the attackers can imitate the victim’s card at an ATM using a card-emulating device, such as a phone, smartwatch, or bespoke hardware, to withdraw cash. The process hinges on social engineering to convince users to install a fake “banking” app and to go through fake “card verification” steps, while the malware stays concealed on the device.

Malwarebytes notes NGate’s ability to forward freshly generated, short‑life codes to sustain instant cash-outs, underscoring the need to avoid phishing attempts and to keep devices protected with trusted security software.