NGate malware enables ATM cash theft via NFC relay
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Android malware impersonates banks to relay NFC card data and PINs to attackers for unauthorized ATM withdrawals.
NGate is a multi-stage Android malware campaign targeting Polish bank customers that enables attackers to withdraw cash using victims' own payment cards without physical theft. The attack chain combines social engineering with technical exploitation: victims receive phishing messages (email/SMS) about banking problems, are directed to download a malicious app, and receive follow-up calls from scammers posing as bank staff. Once installed, the app prompts the victim to tap their physical card against the phone via NFC and enter their PIN using an on-screen keypad. The app captures card NFC exchanges (EMV APDUs) and the PIN, then exfiltrates both to an attacker-controlled server or device positioned at an ATM. The attacker replays this data to withdraw cash.
CERT Polska analyzed multiple samples of the malware, which operates in two NFC roles: reader mode (victim's phone capturing card data) and emitter mode (attacker's phone/ATM-side relay). The app registers as a Host Card Emulation (HCE) payment service, registers for NFC permissions, and uses a native library (libapp.so) to load encrypted configuration from app assets. Configuration—including the C2 server address—is XOR-encrypted with a key derived from the APK signing certificate SHA-256 hash. In the analyzed sample, decryption revealed a live C2 endpoint at 91.84.97.13:5653 communicating over cleartext TCP with a simple framed protocol (length|opcode|body). Card metadata (PAN, expiry, AIDs) and PIN are exfiltrated via dedicated protocol opcodes. The malware is actively distributed and being exploited in the wild against banking users.
Mentioned in this report
Detection guidance
Android APK Sideload Download via Web Proxy
Android client downloading an .apk package over HTTP(S) from a non-official store, the delivery step of phishing-to-malicious-app campaigns such as NGate. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Android APK Sideload Download via Web Proxy
description: Detects an Android user agent requesting a .apk file through the web
proxy from a host other than the official app stores. Phishing SMS/email lures that
send victims to download a banking-themed app (as in NGate) use this delivery pattern.
Generalises on the Android client plus .apk request, not on campaign domains.
tags:
- attack.execution
- attack.t1204.002
- attack.t1204.001
- attack.initial-access
- attack.t1566.002
logsource:
category: proxy
detection:
selection_apk:
c-uri-extension: apk
selection_apk_uri:
c-uri|endswith: .apk
selection_ua:
c-useragent|contains:
- Android
- Dalvik
- okhttp
filter_official_stores:
cs-host|endswith:
- play.google.com
- android.clients.google.com
- play.googleapis.com
- galaxystore.samsung.com
- appgallery.huawei.com
condition: 1 of selection_apk* and selection_ua and not filter_official_stores
falsepositives:
- Corporate MDM or enterprise app distribution servers that host internal APKs
- Developers or testers downloading beta builds from internal or third-party hosting
level: medium
id: bf47cfb3-5fb7-5888-acba-48503388b71f
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2025/11/analiza-ngate
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/11/analiza-ngate
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs