The attackers have learned how to install malware on user devices, capable of blocking and transferring a remote bank card. According to F6, the attacks on customers of Russian banks are carried out using the ligament of the Android Troyan Craxsrat and NFCGATE applications.
Craxsrat penetrates mobile devices under the case of applications and legal updates. After installation, it provides officers of remote management capabilities, including performing various actions without user knowledge. Moreover, Trojan works with NFCGate – a mobile application, on the basis of attackers who create harmful software.
A combination of toxic people allows you to fully access a mobile device, including remote banking applications. The attackers can block both notifications and certification codes from banks and authentication data, they have the ability to withdraw money directly from the victim's card by blocking NFC traffic and map data agreement.
Analysts note that the main vector of the distribution is social technique. The attackers send harmful APK files, disguised in the form of image storage, video files and various applications, through messengers.
NFCGate, in turn, disguised into different applications. Among them are fake applications of publications and parts (including federal tax services, Russian banks, minzifra), non -existing applications of government agencies (for example, central bank protection of malware spread.
For the first time, F6 researchers described the use of NFCGate for criminal purposes in January 2025. In February, the number of such attacks increased by 80% compared to January.
According to F6 analysts, according to the results of March 2025, in Russia, more than 180,000 devices infringed on it Craxssrat and NFCGate were installed.
How to protect yourself from craxssrat and nfcgate:
Do not communicate in messengers with anonymous people, anyone they seem: employees of banks, post and mobile operators, state councils or utilities.
Not following the links from SMS and messages in messengers, even when outside, they look like messages from banks and other official structures.
Do not install applications from SMS links, messengers, letters and suspicious websites. Only install applications from official application stores like Rustore and GooglePlay. Before installing, make sure to check the reviews on the application, paying special attention to negative reviews – this will help identify fake and dangerous programs.
If you are asked to install or update the bank application and send links, call the hotline indicating on the back of the bank card and specify whether the proposal you receive is from the bank.
Do not notify officers of CVV and PINs of bank cards, login and passwords to import online banks. Do not enter these data on unfamiliar, suspicious websites and in the applications you install for the first time.
If you understand that your bank card is violated, immediately blocking it by calling the bank's hotline or using the bank application.