Full Report
A new malware-as-a-service (MaaS) platform named 'SuperCard X' has emerged, targeting Android devices via NFC relay attacks that enable point-of-sale and ATM transactions using compromised payment card data. [...]
Analysis Summary
# Tool/Technique: SuperCard X Malware
## Overview
SuperCard X is a sophisticated piece of Android malware designed to steal payment card details (card number and PIN) from a victim's physical payment card via Near Field Communication (NFC) and subsequently facilitate fraudulent contactless transactions or ATM withdrawals using an attacker-controlled Android device running a counterpart application named "Tapper."
## Technical Details
- Type: Malware family
- Platform: Android
- Capabilities: NFC data theft (reading payment card chip data), mTLS secured C2 communication, ATR-based card emulation for contactless payments.
- First Seen: Not explicitly stated in the text, but it is a recently described threat.
## MITRE ATT&CK Mapping
This malware primarily focuses on data exfiltration and misuse of device hardware.
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
- **TA0011 - Command and Control**
- T1071 - Application Layer Protocol
- T1071.001 - Web Protocols (Implied for C2 communication secured by mTLS)
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (Implied by low-detection status)
## Functionality
### Core Capabilities
- **Payment Card Data Theft:** It tricks victims into tapping their physical payment card against their infected phone via NFC, allowing the malware to read chip data (card number and PIN).
- **Social Engineering:** Threat actors use persuasion techniques, often via messaging apps, to trick victims into downloading the malicious "Reader" app (which contains SuperCard X) and subsequently removing spending limits from their banking apps.
- **NFC Emulation:** The stolen card data is used by the attacker's companion app, "Tapper," to emulate the victim's card using Answer to Reset (ATR)-based emulation, making it appear genuine to payment terminals.
### Advanced Features
- **ATR-Based Emulation:** Uses the official smart card protocol element (Answer to Reset) to ensure the emulated card is technically mature and accepted by point-of-sale systems and ATMs.
- **Secure Communication:** Employs mutual TLS (mTLS) for certificate-based client/server authentication, securing Command and Control (C2) communications against monitoring and analysis.
- **Evasion:** Initially evaded detection on VirusTotal and heuristic scanning due to requesting minimal, non-obvious permissions (primarily NFC access) and avoiding aggressive behaviors like screen overlaying.
## Indicators of Compromise
- File Hashes: [None provided in the text]
- File Names: "Reader" (the disguised installation package via social engineering), "Tapper" (the attacker's counterpart application).
- Registry Keys: [Not applicable/Not provided for Android]
- **Network Indicators:** C2 communications secured via mTLS. (Specific domains/IPs are defanged/not provided, but communication relies on certificate-based authentication).
- **Behavioral Indicators:** Requesting access to the NFC module for the purpose of reading payment card data when prompted by a remote actor.
## Associated Threat Actors
- [Not explicitly named, but the attack relies on human interaction orchestrated by threat actors.]
## Detection Methods
- Signature-based detection: Currently, SuperCard X is reportedly not flagged by major antivirus engines on VirusTotal, indicating signatures are evolving.
- Behavioral detection: Monitoring for applications requesting extensive NFC module access, particularly when combined with social engineering narratives related to bank verification or payment updates.
- YARA rules: [Not provided in the text]
## Mitigation Strategies
- **User Education:** Caution against responding to unsolicited messages asking users to install third-party apps to "verify" or "update" payment cards, especially those requiring NFC interaction.
- **App Sourcing:** Only install applications from the official Google Play Store.
- **Google Play Protect:** Ensure default protections are active, although the malware appears to be distributed outside the official store initially.
- **Transaction Monitoring:** Banks should monitor for unusual small, instant contactless transactions or ATM withdrawals following suspicious user activity.
- **NFC Access Control:** Users must scrutinize permission requests for newly installed apps, especially those requesting specialized hardware access like NFC, if the app's stated purpose does not align with this access.
## Related Tools/Techniques
- **Tapper:** The necessary companion Android application run by the attacker to utilize the stolen card data for legitimate-looking contactless fraud.
- NFC Relay Attacks: The broader category of attacks leveraging NFC technology for fraudulent skimming.