techhub.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A hub primarily for passionate technologists, but everyone is welcome

Administered by:

Server stats:

4.6K
active users

#androidmalware

2 posts1 participant0 posts today

🚨 A new Android malware campaign is using NFC relay attacks to clone credit cards — and it’s nearly invisible to antivirus tools.

Security researchers have discovered 'SuperCard X', a malware-as-a-service (MaaS) platform that allows cybercriminals to steal card data and make contactless payments using compromised Android devices.

Key highlights from the report:
- Distributed via social engineering scams through fake SMS or WhatsApp messages
- Victims are tricked into installing a malicious app disguised as a bank “verification” tool
- Once installed, it uses NFC to read card chip data and sends it to a second attacker device
- Attackers use a companion app to emulate the victim’s card and make payments or ATM withdrawals

🔍 What makes it dangerous:
- SuperCard X requests minimal permissions, making it hard to detect
- It uses ATR-based card emulation and mutual TLS (mTLS) for secure communication
- Malware is not flagged by any antivirus engines on VirusTotal
- Transactions are small, instant, and look legitimate to banks — making them harder to detect or reverse

🛡️ Google responded saying Play Protect is active and currently no such apps are listed on Google Play. But since these apps spread outside the store, Android users remain at risk — especially if they sideload apps or fall for impersonation scams.

This is a textbook example of how mobile payment infrastructure is being exploited — and why NFC security deserves more attention in mobile-first threat models.

At @Efani we’re committed to helping protect high-risk users from silent, evasive mobile threats just like this.

Our latest summary is out, looking at an emerging Crypto-theft Trojan and a promising new recovery tool.

Stay ahead of the curve and read the full post here: opalsec.io/daily-news-update-s

📱 Crocodilus Android Malware: This nasty piece of work is targeting crypto wallets by using fake overlays to steal seed phrases. It's bypassing security measures and using social engineering to gain access. Watch out for this one, especially if you have users in Turkey and Spain! 🇪🇸 🇹🇷

🛠️ Key Takeaways:
* 🔑 Steals crypto wallet seed phrases using Accessibility Logger.
* ⚠️ Bypasses Android 13 security and Play Protect.
* 🤖 Employs 23 bot commands, including call forwarding and RAT functionality.
* 📵 Hides activities with black screen overlays and muting.

💻 Microsoft's Quick Machine Recovery Tool: Microsoft is testing a new tool for Windows 11 that could be a game-changer for dealing with boot crashes caused by buggy drivers and configurations. Imagine remotely fixing those dreaded BSODs! 🚀

✨ Here's the lowdown:
* ⚙️ Remotely fixes boot crashes caused by bad drivers/configs.
* 🌐 Connects to Microsoft's servers to apply fixes.
* 🛡️ Could have made life much easier when recovering from the worldwide CrowdStrike outage from July last year.
* 🏢 Customizable for enterprise users via RemoteRemedation CSP.

Don't forget to sign up for Opalsec to get actionable insights delivered straight to your inbox! 📩 opalsec.io/daily-news-update-s

Let me know your thoughts in the comments below! 👇