Table of contents
- The new threat is called SuperCard X
- How the NFC relay attack works
- What makes SuperCard X dangerous
- SuperCard X makes NFC relay attacks a real-world danger
The new threat is called SuperCard X
SuperCard X is the new Malware-as-a-Service (MaaS) platform discovered by Cleafy Labs, representing a growing danger for NFC payments.
Created by Chinese-speaking cybercriminal groups, this malware can intercept and retransmit NFC communications between a payment card and a POS or ATM, enabling remote fraudulent transactions without the need for the physical card.
How the NFC relay attack works
The SuperCard X malware operates stealthily, exploiting Near Field Communication to capture contactless card data through an infected smartphone. Once acquired, the data is sent to a remote device, which uses it to perform instant, unauthorized transactions.
Attackers use social engineering techniques like smishing and fake telephone support calls (TOAD) to trick victims into installing malicious apps. During the call, users are convinced to bring their NFC card close to their phone, allowing the malware to capture and transmit sensitive information.
What makes SuperCard X dangerous
Among the key features identified by Cleafy Labs, SuperCard X stands out for:
- Low detection profile
Hard to detect by antivirus solutions. - Similarity to NGate
Probable evolution of known malware. - Wide spread
Promoted on Telegram with direct affiliate support.
The malware uses two apps: a Reader to capture NFC data and a Tapper to emulate the card at POS or ATMs. Communications between the apps are protected via Mutual TLS (mTLS), ensuring high-level protection against forensic analysis and interception.
SuperCard X makes NFC relay attacks a real-world danger
Experts emphasize that NFC relay attacks are no longer a theoretical risk. SuperCard X has proven these scenarios are now operational, with cases already identified in Italy.
Banks, card issuers, and end users must increase their vigilance, implementing real-time detection systems and advanced security measures.
