Overview

• Victims are prompted to tap their card, with details exfiltrated in real time for use at NFC terminals or ATMs.
• Attackers drive installs through Google Play lookalike pages that promote sham security tools backed by fabricated positive reviews.
• Threat Fabric reports the operation is most active in Brazil and is spreading to other regions with widespread contactless payments.
• A secondary app installed on devices of money mules forwards stolen card data, complicating tracing and takedown efforts.
• Researchers urge banks to tighten monitoring of NFC and remote transactions, and they advise users to install only from the official Play Store and to refuse any app request to tap or enter a card PIN.