{
  "name": "NFC Fraud Wave: Evolution of Ghost Tap on the Dark Web",
  "slug": "nfc-fraud-wave-evolution-of-ghost-tap-on-the-dark-web",
  "description": "Chinese cybercriminals are exploiting NFC technologies for fraudulent purposes, targeting financial institutions and consumers worldwide. They use sophisticated tools like Z-NFC and King NFC to facilitate illegal transactions at scale. The fraudsters leverage Host Card Emulation (HCE) to mimic physical NFC smart cards and create 'farms' of mobile devices to automate fraud. They target countries including the US, UK, EU, Australia, Canada, and others. The criminals also abuse NFC-enabled POS terminals and exploit loyalty points programs. This growing threat has led to significant financial losses and poses serious risks to payment security and digital identity systems globally.",
  "published": "2025-04-23T17:45:46+00:00",
  "created_at": "2025-04-23T17:45:46+00:00",
  "modified_at": "2025-04-23T21:02:57+00:00",
  "created_at_opencti": "2025-04-23T17:45:46+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-04-23",
    "carding",
    "contactless payments",
    "ghost tap",
    "host card emulation",
    "king nfc",
    "loyalty points fraud",
    "mobile wallets",
    "nfc fraud",
    "ngate",
    "pos terminals",
    "track2nfc",
    "z-nfc"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://znfcqwe.top"
      },
      {
        "id": "",
        "name": "znfcqwe.top"
      },
      {
        "id": "",
        "name": "1663a67a95612552caf850604657ddc508161a1fb2a25144abffec8c5213a77b"
      }
    ],
    "malware": [
      {
        "id": "7ea76bd4-47cc-4b69-bfd3-1b7c1303d70e",
        "name": "King NFC",
        "slug": "king-nfc"
      },
      {
        "id": "fb7b910c-7a93-4d7d-bca7-771ced7b73d2",
        "name": "Z-NFC",
        "slug": "z-nfc"
      },
      {
        "id": "e0cdad69-79b2-4032-83ad-04b75cfec081",
        "name": "Track2NFC",
        "slug": "track2nfc"
      },
      {
        "id": "34374165-e0b9-462f-8df2-79e0cf62060b",
        "name": "NGate",
        "slug": "ngate"
      }
    ],
    "intrusion_sets": [
      {
        "id": "5a35e635-c001-4091-a3bb-d3dbb382a3c4",
        "name": "Chinese cybercriminal groups",
        "slug": "chinese-cybercriminal-groups"
      }
    ],
    "attack_patterns": [
      {
        "id": "c22b5073-f426-4294-98bb-219d17345158",
        "name": "T1553.002"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "2e0c6db7-16a7-4bf6-992e-263474014fce",
        "name": "T1059.004"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "New Zealand"
      },
      {
        "id": "",
        "name": "Australia"
      },
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "Saudi Arabia"
      },
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "United Arab Emirates"
      },
      {
        "id": "",
        "name": "Canada"
      },
      {
        "id": "",
        "name": "Japan"
      },
      {
        "id": "",
        "name": "Malaysia"
      },
      {
        "id": "",
        "name": "Philippines"
      },
      {
        "id": "",
        "name": "United Kingdom of Great Britain and Northern Ireland"
      },
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Retail"
      },
      {
        "id": "",
        "name": "Transportation"
      },
      {
        "id": "",
        "name": "Finance"
      }
    ]
  },
  "external_refs": [
    "https://www.resecurity.com/blog/article/nfc-fraud-wave-evolution-of-ghost-tap-on-the-dark-web",
    "https://otx.alienvault.com/pulse/6809436ac67098f19bfd41e5"
  ]
}