NGate

NGate is a malicious software (malware) that has been observed in the wild, primarily targeting Android devices. It was first identified by researchers from ESET who described it as unique due to its ability to exfiltrate Near Field Communication (NFC) traffic, allowing it to steal sensitive information such as contactless card data. The malware is delivered to victims via an SMS link which prompts them to download the NGate application, often from websites impersonating legitimate services. The NGate malware uses two distinct servers to facilitate its operations. One is a command and control (C2) server, which was first identified on February 21, 2024, and then again on April 7, 2024. This server is used for communication with the infected devices, specifically using port 5566 to relay NFC traffic data. In addition to the C2 server, NGate also utilizes distribution websites to spread the malware. These sites were identified on March 5 and March 12, 2024. Two different groups have been associated with the NGate malware campaign. One group used a Telegram bot to log entered information into a Telegram group chat through the official API. The other group employed a traditional C2 server with an administrative panel. With physical proximity, the same NGate malware could be used to 'read' contactless card data through unattended bags and similar means. Thus, NGate presents a significant threat to personal security and privacy, and measures should be taken to protect against it.