Ghost Tapped: Tracking the Rise of Chinese Tap-to-pay Android Malware

Key Takeaways

• Chinese threat actors are deploying NFC-enabled Android applications to carry out unauthorized tap-to-pay transactions remotely using victim’s bank cards.
• Multiple app variants are promoted and sold across Chinese cybercrime communities on Telegram.
• Victims are lured into installing APKs and tapping their cards to their device through smishing and vishing campaigns.
• Illicitly acquired POS terminals are used for cash-outs, with terminals from major institutions openly advertised on Telegram. At least $355,000 in illegitimate transactions have been recorded from one POS vendor alone throughout November 2024 – August 2025.
• In another observed scenario, mobile wallets preloaded with compromised cards are used by mules across the globe to make purchases.
• Over 54 APK samples have been identified, some masquerading as applications of legitimate institutions.

Introduction

Group-IB researchers have observed the growing proliferation of NFC-enabled Android tap-to-pay malware developed and sold within Chinese cybercrime communities on Telegram.

Also referred to as “Ghost Tap”, these applications are used to relay NFC communications between a victim’s device or a mobile wallet loaded with compromised payment cards, and the criminal’s device. This technique allows criminals to complete payments or cash-out remotely as though the victims’ cards were physically present.

Public reporting indicates that victims are targeted via smishing and vishing campaigns, with criminals luring victims into installing these NFC-enabled malware and tapping their bank cards against their phone. Payment data is then relayed through a command and control (C2) server operated by the cybercriminals to their own device, where fraudulently obtained point-of-sale (POS) terminals–sometimes sold by affiliates of the malware vendors–are then used to cash out funds.

In other instances, criminals use mobile devices with wallets pre-loaded with compromised bank cards instead of directly targeting individuals. Publicly disclosed arrests by authorities around the globe also point to networks of mules employed to purchase goods in physical stores using these modified tap-to-pay applications.

In both scenarios, the tap-to-pay scam typically involves two applications:

• A “reader” – installed on the victim’s device to communicate with bank cards
• A “tapper” – installed on the threat actor’s device to conduct transactions

From August 2024 through August 2025, multiple tap-to-pay applications were documented in the cybersecurity community, including NGate in August 2024, ZNFC in February 2025, SuperCard X in April 2025, and most recently, PhantomCard in August 2025.

Group-IB Threat Intelligence Portal:

Group-IB customers can access our Threat Intelligence portal for detailed information about TX-NFC, NFU Pay, and other malware profiles.

Background: Notable Arrests & Advisories Around the World

Overview of Chinese Tap-to-pay Malware Ecosystem

This section highlights the most prominent vendors observed during the research period. Note that this is not intended to be a comprehensive census of all active tools or vendors, as the scheme appears to be continuously evolving with new vendors and applications entering the market.

The tap-to-pay malware described in this blog are primarily distributed and advertised within Chinese cybercrime communities on Telegram, where they are sometimes referred to as “CardWallet” or “remote pay” tools.

Group-IB’s Threat Intelligence team have identified three major vendors in these communities during the research period, including TX-NFC, X-NFC and NFU Pay, as well as other smaller-scale vendors redistributing or promoting variants of these applications.

While multiple variants were also detected, their core functionality remains consistent, with differences mainly being user interface and design, plus scale of distribution and promotion.

1. TX-NFC

One of the largest vendors identified on Telegram is TX-NFC, established on the 7th of January, 2025. The channel had over 21,000 subscribers at the time of detection. The group is administered by three individuals and offers customer support in English, with support staff operating on shifts from 18:00 to 10:00 & 08:00 to 12:00 Beijing time.

This vendor promotes an application also named “TX-NFC”, with prices ranging from $45 for one day of access up to $1,050 for three months of access. TX-NFC is distributed as two separate applications: One as a “reader” and another as a “tapper”, each serving their respective function exclusively.

2. X-NFC

Another vendor; X-NFC, was first seen on the 16th of December, 2024, and had already garnered over 5,000 members in its Telegram group.

Notably, this vendor introduces a new feature, where users can select the device running X-NFC as a “card” or “pos”, allowing a single device to operate as either reader or tapper via the same application.

3. NFU Pay

NFU Pay was first seen on the 1st of April, 2025, and while this vendor maintains a comparatively lower number of subscribers, their application appears to be redistributed by other vendors under different names.

The NFU application offers the same dual-use feature seen in X-NFC, where users can select whether the device with NFU installed is a “reader” or “tapper”.

App Sample Analysis

TX-NFC

As with many other tap-to-pay applications, some TX-NFC samples are both obfuscated and packed using 360 Jiagu; a Chinese commercial-packer:

Figure 6. VirusTotal – Packed TX-NFC sample (SHA1: 2bab45078f0b1384c6f5afd8e341231c9555abce).

As defined in its manifest file, the application requires NFC hardware and card emulation to function:

TX-NFC requests the following permissions to access NFC hardware, access the internet and continue running if the user is not directly using the application:

The application has two activity components, the first of which; “LoginActivity” handles user authentication and serves as the application’s main entrypoint:

Figure 7. LoginActivity manifest entry.

The second activity, “MainActivity” handles intents when an NFC tag is discovered by the device:

Figure 8. MainActivity manifest entry.

In MainActivity, a resource file (nfc_tech_filter.xml) is defined which contains a list of NFC tag types that trigger MainActivity when discovered:

Upon logging in, TX-NFC sends the username, password and device ID to the C2 server:

Figure 9. LoginActivity performs initial authentication.

When an NFC tag is discovered, MainActivity is called which performs basic checks, attempts to communicate with the NFC tag and handles failures:

Figure 10. MainActivity triggers upon NFC tag proximity.

The application then sends the APDU command “2PAY.SYS.DDF01” (Proximity Payment System Environment) to the NFC tag, and stores the available application IDs from the response:

Figure 11. If it’s a payment card, MainActivity will store the relevant data returned.

MainActivity then starts WebSocketService, which is responsible for communicating with the C2 server and relaying messages between the threat actor’s device (tapper) and the victim’s device (reader):

Figure 12. MainActivity then starts WebSocketService to communicate with the C2 server.

Figure 13. Method responsible for relaying APDU commands to the NFC tag.

Figure 14. WebSocketService – message relay.

NFU

NFU requests permissions related to NFC, networking and broader device permissions:

LoginActivity is the main entry point of NFU, which performs limited device fingerprinting, handles user authentication and sets the application’s state as a reader or tapper.

Figure 15. Collection of the Android ID & handling pre-authenticated users.

Figure 16. User-set application state; POS_terminal (tapper) or Card_reader (reader).

Upon logging in, the username, password, device’s Android ID and application’s state (POS_terminal/Card_reader) are sent to the C2 server:

Figure 17. ApiService.login method.

Once the user is authenticated, MainActivity handles basic checks such as ensuring the app has NFC permissions, and prompts the user to set NFU as the default NFC payment application:

Figure 18. MainActivity checks for permissions and default payment app.

Unlike TX-NFC, NFU uses an MqttService class to handle relaying messages.

When an NFC tag is discovered, it clears the queue and sets up a repeating card connection check:

The MqttService class has defined channels which are used for relaying messages via a websocket between the reader and tapper through the C2 server:

When a message is received from the C2 server, it is sent using the NfcService class to the NFC tag:

Figure 21. NfcService.

Code overlaps & custom variants

While conducting this research, Group-IB investigators posed undercover as potential buyers, and in a conversation with the threat actor, the administrator of NFU Pay divulged that they provide customized builds upon request, with modifications for Brazil and Italy reportedly including the removal of login requirements on the reader’s side, likely intended to facilitate faster victim targeting. As observed in the PhantomCard discovery, the application also appears to be an NFU variant.

Similarly, TX-NFC also appears to be based on another project; NFCProxy, which is available on GitHub.

This is evident by the similar package names:

In addition to both applications having the same main activity name and definitions:

POS Terminal vendors: How tap-to-pay scammers cash out

Oedipus

Oedipus is a Telegram channel closely affiliated with TX-NFC and other tap-to-pay application vendors, which has been operating since the 11th of November, 2024.

At the time of detection, the channel had amassed over 500 subscribers, with frequent advertisements of POS terminals from financial institutions worldwide, including the Middle East, Africa, and Asia.

These POS terminals are often used in conjunction with tap-to-pay schemes as a means to cash out stolen funds once the victim’s NFC payment data has been relayed to the cybercriminal’s device.

Based on information gathered from the Oedipus Telegram channel, the group has conducted roughly $355,000 in transactions between November 2024 and August 2025 using these illegitimately obtained POS terminals.

Figure 25. Transactions posted on Oedipus’ Telegram channel from November 2024 to August 2025.

Tap-to-pay Scams are a Growing Concern

Based on Group-IB Fraud Protection data tracked from May 2024 to December 2025, we can observe a steady increase in the detection of tap-to-pay malware samples. At the same time, different families and variants are also appearing, while the old ones remain active. This indicates the spread of this technology among fraudsters. We have also included a breakdown of TX-NFC and NFU statistics below:

General Statistics (All Variants)

Figure 26. Breakdown of unique samples, package names & fingerprints by type.

Figure 27. Total detections per country/region by type.

TX-NFC

Figure 28. Total detections of TX-NFC samples by day.

NFU

Figure 29. Total detections of NFU samples by day.

Recommendations

For financial institutions & payment networks

• Educate end-users about best practices and promote awareness and vigilance around vishing, smishing and other malicious campaigns.
• Leverage Threat Intelligence services for the latest information and updated threat feeds.
• Using a Fraud Protection session monitoring system will enable the detection of malicious applications on user devices, as well as unusual behavior and logins from compromised devices.
• Monitor for quick successions of card enrolments in mobile wallets.
• Monitor for rapid successions of transactions conducted across a wide geographic area.
• Enhance merchant vetting and strengthen know-your-customer (KYC) checks.

For individuals

• Exercise caution around messages and calls received from unknown numbers, and especially those relating to your financial information or activity.
• Do not click on suspicious links or download files shared from unknown sources.
• Install applications only through official, trusted sources.
• Continuously review your bank card(s) settings as many mobile banking applications allow for customizable restrictions.
• Proactively inform relevant authorities and your bank in case compromise of your payment card is suspected.

Group-IB Fraud Matrix

Indicators of Compromise (IOCs)

Files

Network indicators

• nfc[.]rc8820[.]com
• xxnfc[.]com
• txnfc[.]com
• apk[.]nfu20251021[.]win
• app[.]nfu1010[.]com