Analysis of NGate malware campaign (NFC relay)

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://cert.pl/en/posts/2025/11/analiza-ngate/
• Blog Title: Analysis of NGate malware campaign (NFC relay)
• Suggested Section: Generic Methodologies & Resources -> Pentesting Network -> NFC/EMV Relay Attacks (Android HCE relay, APDU forwarding, PIN harvesting)

🎯 Content Summary

Threat overview
NGate is an Android-based NFC relay kit used to cash out ATMs with the victim’s own payment card. Operators social-engineer victims into sideloading an app (e.g., from files[.]fm/u/yfwsanu886), tapping their physical card against the phone (NFC reader mode), and entering the card PIN. The app relays EMV APDUs and the PIN over a simple framed TCP protocol to an attacker device at an ATM or to a proxy C2, enabling real-time ATM withdrawals.

App s...

🔧 Technical Details

NFC relay via Android reader↔HCE emitter: Use a victim device in NFC reader mode to capture live EMV APDUs and the card PIN, then forward them to an attacker device implementing HostApduService (HCE) at the terminal. The emitter relays APDUs to the ATM, enabling withdrawals as if using the victim’s card.

HCE abuse with no unlock: Declare an Android host-apdu-service with android:requireDeviceUnlock="false" and a payment AID. In processCommandApdu, forward inbound APDUs upstream and return minimal responses, acting as a transparent relay endpoint.

Config concealment via cert-derived XOR: Store C2 config as ASCII‑hex under assets/____ and decrypt at runtime by XOR-ing with a 32‑byte key computed as SHA‑256 of the app signing certificate (DER). This hides host/port/token from simple static checks and couples config to the signing key.

Cleartext framed C2 channel: Implement cli...

🤖 Agent Actions

I explored the repository and found the most relevant place for NFC/EMV relay content is the existing RFID/NFC page under todo/radio-hacking. It already covers HF NFC/EMV basics and tooling (Flipper, Proxmark), so I extended it with a concise, technical section documenting Android-based NFC relay via Host Card Emulation (HCE), APDU forwarding, PIN harvesting, framed C2 protocol, and config concealment derived from the APK signing certificate—abstracted from the provided CERT-PL NGate analysis.

What I changed:

• Updated src/todo/radio-hacking/pentesting-rfid.md by adding a new section “NFC/EMV Relay via Android Reader↔HCE Emitter” with:
  • Android HCE manifest and hce.xml snippets (payment AID, requireDeviceUnlock=false)
  • HCE service relay code stub (processCommandApdu forwarding)
  • Reader-side EMV scheme inference by AID and PIN harvesting pattern
  • Framed C2 protocol (int32 len/opcode/body) and keepalive behavior
  • Config concealment technique (XOR with SHA-256 of signing certificate) and a short PoC for offline decryption using apksigner + Python
  • End-to-end relay chain and hunting/DFIR notes
  • Brief mitigations
• Appended References with:
  • The CERT-PL NGate malware campaign analysis URL
  • Android apksigner docs
  • Android HCE overview

No new files were created.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 907
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://cert.pl/en/posts/2025/11/analiza-ngate/

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources -> Pentesting Network -> NFC/EMV Relay Attacks (Android HCE relay, APDU forwarding, PIN harvesting)".

Repository Maintenance:

• MD Files Formatting: 907 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0