⚡ Weekly Recap: NFC Fraud, Curly COMrades, N-able Exploits, Docker Backdoors & More

Summary: A new Android trojan called PhantomCard is abusing near-field communication to run relay attacks against banking customers in Brazil, instructing victims to place their credit or debit card on the back of the phone so the card data can be sent to an attacker-controlled NFC relay server. The stolen details are then passed to money mules who link them to contactless payment systems like Apple Pay or Google Pay to buy physical goods in person.
Key Takeaway: The card never leaves the victim's hand and no PIN is entered, yet the data is enough for a mule to walk into a store and pay with it - a fraud path that card-present controls and customer awareness scripts were not built to catch.

Read the original at The Hacker News ↗

Topics: Malware
Mentions: CVE-2024-42512 CVE-2024-42513 CVE-2025-1468 CVE-2025-20265 CVE-2025-25256 CVE-2025-30404 CVE-2025-30405 CVE-2025-42950 CVE-2025-42957 CVE-2025-47227 CVE-2025-47228 CVE-2025-49090 CVE-2025-49457 CVE-2025-52970 CVE-2025-53652 CVE-2025-53773 CVE-2025-53779 CVE-2025-54315 CVE-2025-54472 CVE-2025-5456 CVE-2025-5462 CVE-2025-54949 CVE-2025-54950 CVE-2025-54951 CVE-2025-54952 CVE-2025-55004 CVE-2025-55154 CVE-2025-6186 CVE-2025-7384 CVE-2025-7734 CVE-2025-7739 CVE-2025-8341 CVE-2025-8355 CVE-2025-8356 CVE-2025-8671 CVE-2025-8875 CVE-2025-8876
Related: CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises Cyber Risks ·
CVE-2025-8875: N-able N-Central Insecure Deserialization Vulnerability Known Exploited Vulnerabilities · Aug 13, 2025
CVE-2025-8876: N-able N-Central Command Injection Vulnerability Known Exploited Vulnerabilities · Aug 13, 2025