ESET Researchers Uncover Crimeware Campaign Targeting Czech Banks

In a shocking revelation, ESET researchers have uncovered a sophisticated crimeware campaign targeting clients at three Czech banks. The malware, named NGate, has a unique ability to relay data from victims’ payment cards via a malicious app installed on their Android devices to the attacker’s rooted Android phone. The ultimate goal of this campaign was to facilitate unauthorized ATM withdrawals from the victims’ bank accounts.

The novel technique used by NGate involves relaying near field communication (NFC) data from the victims’ physical payment cards through their compromised Android smartphones to the attacker’s device. This data was then used to perform ATM transactions, with a fallback plan in place to transfer funds to other bank accounts if needed.

Lukáš Štefanko, the researcher who discovered this new threat, highlighted the use of a tool called NFCGate, originally designed by students in Germany, as the basis for the malware’s technique. Victims unknowingly downloaded and installed the malware after being deceived into thinking they were communicating with their bank, ultimately compromising their own devices.

The attackers behind NGate have been linked to phishing activities targeting Czech banks since November 2023. ESET believes these activities were temporarily halted following the arrest of a suspect in March 2024. The malware was distributed through deceptive domains impersonating legitimate banking websites or official mobile banking apps, with victims lured in through fraudulent SMS messages.

NGate not only has phishing capabilities but also utilizes NFCGate to relay NFC data between devices, prompting victims to enter sensitive banking information. To protect against such complex attacks, Štefanko advises proactive measures such as checking URLs, downloading apps from official stores, keeping PIN codes secure, using security apps, and turning off NFC when not in use. This revelation serves as a stark reminder of the evolving tactics used by cybercriminals and the importance of staying vigilant in safeguarding personal information.