Russian bank customers are being targeted by a new malware called SuperCard. According to Dmitry Yermakov, head of the financial fraud department at F6, hackers previously used this money-stealing method in Italy, expanding its reach afterwards to include other regions like Europe, the US, and Australia.
This application allows cybercriminals to intercept NFC data, including bank card details. Subsequently, attackers steal funds from victims` accounts. F6 experts clarified that SuperCard is based on NFCGate, a legitimate German application from 2015 originally designed for NFC monitoring. However, since 2023, it has been found on the dark web and is now used for illicit purposes.
«Among all threats to Russian bank clients, malicious versions of NFCGate are developing the fastest. In less than a year, the arsenal of attackers targeting Android users in Russia has expanded to numerous modifications, with their number increasing almost every week,» Yermakov added.
F6 analysts believe that SuperCard is currently in the testing phase in Russia. However, considering all types of malware based on NFCGate, the total damage in the first quarter of 2025 reached 432 million rubles, and the number of compromised Android devices exceeded 175,000.
«Developers of criminal tools constantly revise and improve their technologies, and organizers of criminal schemes are always searching for new instruments. They use both their own developments and borrow solutions successfully applied by criminals in other countries for attacks on Russian bank clients,» Yermakov concluded.
It was also previously reported that fraudsters are increasingly using phishing websites to deceive Russians. Most of these are fake resources pretending to be platforms for online shopping or investments.
