Iran-linked hackers shut down a UK power plant for four days in the first confirmed attack of its kind, concurrent with water infrastructure attacks across 12 US states. Iran-linked hackers shut down a British power plant for four days in what The Telegraph describes as the most successful cyberattack of its kind against UK energy infrastructure. “Iran shut down a British power plant for four days in an unprecedented cyber attack, The Telegraph can disclose.” reads the report published by The Telegraph. “It is thought to be the first time that hackers affiliated to the Iranian regime have succeeded in closing down such a facility in the UK, and is believed to be the most successful cyber attack of its kind.” British officials did not name the power plant because of security concerns. Staff worked for four days to restore it, but the plant was small and the outage did not affect the UK’s wider power supply. Still, the government warned power companies and businesses about the incident and provided guidance on how to respond. The attack was reported to the National Cyber Security Centre (NCSC), part of GCHQ, which helps protect the UK’s critical infrastructure. The NCSC did not comment on the specific incident. The US water infrastructure attacks hit dozens of wastewater treatment plants across 12 states, causing flooding and loss of pressure from taps. Authorities in affected areas told customers to boil water. The first reports came from Minnesota on July 26, followed by similar breaches in Michigan, Georgia, South Dakota, and New Jersey. The FBI attributed those incidents to “malicious cyber actors”; US government sources later confirmed the threat most likely originated in Tehran. The UK attack is not thought to have been designed to harm civilians. The more probable intent was to demonstrate that hackers linked to Iran’s Islamic Revolutionary Guard Corps could gain access to UK infrastructure and shut it down at will. A four-day outage at a small generator that nobody outside the industry noticed is, from that perspective, a successful proof of concept. Iran has accelerated its cyberattacks on Western countries since the US and Israel began air strikes in February. Suspected Iranian operations have been reported in Germany, Poland, Finland, Belgium, and Albania, with Israel and other Middle Eastern countries remaining the most frequent targets. In March, the NCSC advised British organisations to review their security posture in light of the wider conflict. NCSC chief executive Richard Horne said in June that the agency had handled more than 200 attacks on critical national infrastructure in the previous year alone. The timing is awkward for the intelligence and security committee, which oversees UK spying agencies. “Experts have long warned that the UK is unprepared for the scale of the threat of malicious cyber attacks from foreign adversaries, and the intelligence and security committee, which oversees spying agencies, reported last year that the chance of an Iranian cyber attack on British infrastructure was “unlikely”.” continues the report. A Cabinet Office risk assessment published last month placed the probability of a serious and successful cyberattack on domestic infrastructure at between five and twenty-five percent. The same document warned that AI is making attacks faster and cheaper to run, and is lowering the technical bar for anyone wanting to attempt them. The government’s public response leaned hard on the size of the target. A government source told The Telegraph: “We have thresholds for important generators to legally notify us of cyber activity, and this site is nowhere near. It’s a very small-scale site, less than a rounding error compared to grid capacity.” A government spokesman said the UK has a strong and resilient energy system and that the incident never threatened the wider power network. While both statements are technically true, they do not answer a key question: should it be considered acceptable for even a small power plant to remain offline for four days? Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iran-Linked Hackers)
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. ToxicPanda 2.0 Gets a Major Upgrade, Expanding Attacks Across 16 CountriesMalware Hijacks Android Car Head UnitsCritical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command ExecutionU.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalogYour Shredded Visa Card May Still Work at the CheckoutSix Maximum-Severity Flaws Found in Cisco ProductsFake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage TacticsGitLab Warns of Active Exploitation of Critical GraphQL FlawPoland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite FlawU.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalogCl0p Targets 40+ Organizations Through PTC Windchill FlawManic: The Android Malware That Exfiltrates Data Even When the Phone Is OfflineNSA, CISA, FBI, DOE, and EPA Warn of Active AI-Assisted Attacks on Siemens S7 PLCsU.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalogUS Indicts 17 Iranians Over Years-Long Cyber Espionage CampaignStopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal NetworkInside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua CamerasMicrosoft Tracks MacSync Stealer by Its Behavior, Not Its Domains50,000 Stripe Secrets Leaked in Public CodeU.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalogHackers Expose Data of 1.2 Million Heights Finance CustomersProject noRecognition: Teaching AI to Fool Surveillance CamerasGitLab Patches Critical Unauthenticated GraphQL VulnerabilityU.S. CISA adds a Ray-Project Ray flaw to its Known Exploited Vulnerabilities catalogNew Mirai-Based Evooo1Bot Botnet Targets Linux DevicesSafePal Says 39,798 Customers Hit by Data BreachLiteLLM Supply-Chain Attack – Technology, Banking and Healthcare the Most AffectedInvisible AI Prompts Trigger Court SanctionsMcDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records StolenAkira Ransomware Uses Safe Mode to Bypass EDRDDoS Attacks Cause Major Threema OutagesMustang Panda Upgrades CoolClient With a Kernel RootkitSophisticated Cyberattack Exposes Data of 678,000 French TaxpayersAPT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2 International Press – Newsletter Cybercrime McDonald’s employee data listed for sale in wider Entra campaign $7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret Live Stripe keys for 659 merchants, published for free Clop Returns with Custom Implant in Mass-Extortion Campaign Justice Department Secures $400M Settlement with TikTok and ByteDance to Resolve Children’s Privacy Litigation Malware Akira Hits Safe Mode: Ransomware Rebooting Around EDR Hunting MacSync Stealer infrastructure through behavioral pivots Manic: Blend between Banking Malware & Spyware The ToxicPanda Never Sleeps: ToxicPanda 2.0 Prepares its Next Strike on Mobile The invisible passenger in your car Grandoreiro goes north: From Brazil to Mexico with a new DLL sideloading campaign Hacking Large-scale DDoS attacks disrupted Threema secure messaging service The LiteLLM Supply-Chain Attack — TeamPCP “SANDCLOCK” CI/CD Credential-Harvesting Campaign via a Backdoored Trivy GitHub Action Actively exploited vulnerability in Zimbra Collaboration Suite AI-assisted tool helped secure satellite communication system after 2022 Russian hacking Expired credit cards revived by researchers to make unauthorized payments CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks When the NASA Ground Station Has No Lock on the Door: Unauthenticated Command Execution in AIT-GUI (GHSA-p9r8-2q67-fp86) Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories Intelligence and Information Warfare Operation CameraSwarm: Over 14,000 Dahua cameras compromised across Ukraine and Russia 17 Iranians Charged with Conducting Massive Cyber Theft Campaign on Behalf of the Islamic Revolutionary Guard Corps and Other Iranian Entities Defending Against an Active Threat to Siemens S7 Series PLCs Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia SilkParasite: Tracking a China-Nexus APT Across Central Asia Revealed: Cyber spies used malware from GitHub to hack EncroChat cryptophone network Cybersecurity France probes unprecedented cyberattack after tax data of 678,000 users stolen Person Hides Prompt Injection in Legal Filing Telling AI to Side With Them SafePal Unauthorized Access To A Subset Of Customer Order Information This ‘adversarial’ pattern can prevent surveillance cameras from detecting you France’s cybersecurity problem demands strong political will The Powerful Chinese AI Model Experts Warned About—and Waited for—Is Here OpenAI president says companies should do 10 things ASAP to defend against AI cyber threats Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
ToxicPanda 2.0 targets 349 financial apps and abuses Android Wireless Debugging to gain deeper device access and steal banking credentials. ToxicPanda used to be a Europe-focused nuisance targeting a manageable list of banks. That version is gone. Zimperium’s zLabs team just documented ToxicPanda 2.0, and the numbers alone tell the story: 349 targeted financial institutions across 16 countries, up from 16 apps in the previous version, plus a command set that ballooned to 167 remote instructions. The infection starts with a fairly standard trick dressed up in a new coat of paint. The malware poses as a dropper, requesting VPN permissions through a fake installation screen, then quietly uses that access to block communication from Google Play Protect while it decrypts and installs the real payload hiding inside the app’s own asset files. Once installed, it leans on Android’s Accessibility Service, the same feature legitimate screen readers and automation tools rely on, to see and interact with everything happening on the victim’s screen. ToxicPanda was once a malware mainly targeting a small number of European banks. That has changed. Zimperium’s zLabs team has documented ToxicPanda 2.0, which now targets 349 financial institutions in 16 countries, compared with just 16 apps before. It also has 167 different commands that attackers can send remotely. The attack starts with a common trick. The malware pretends to be a legitimate app and asks for VPN permissions through a fake installation screen. It then uses this access to block Google Play Protect while secretly installing the real malware hidden inside the app’s files. Once installed, ToxicPanda abuses Android’s Accessibility Service. This feature is normally used by legitimate tools such as screen readers, but the malware uses it to monitor the victim’s screen and interact with apps and data on the device. “By abusing the Android Accessibility Service, threat actors can steal every UI element on the screen, alongside an overlay-based credential theft mechanism targeting 349 financial institutions, compared to the previous version, which targeted only 16 banking applications, the latest iteration demonstrates a significant expansion in targeting scope and capabilities.” reads the report published by Zimperium’s zLabs. “Several commands previously identified as unimplemented in Cleafy’s analysis are now fully operational, expanding the malware’s remote control and fraud capabilities.” What sets this version apart isn’t just scale, it’s a genuinely new privilege escalation trick built around a feature most people have never touched: Android’s Wireless Debugging framework. The malware automates the entire process of turning it on, tapping the build number seven times to unlock developer options, toggling wireless debugging, and then scraping the six-digit pairing code straight off the screen using accessibility permissions. From there it performs the actual cryptographic pairing handshake itself, gaining shell-level access to the device without the victim ever realizing developer mode got switched on. ToxicPanda was once a malware mainly targeting a small number of European banks. That has changed. Zimperium’s zLabs team has documented ToxicPanda 2.0, which now targets 349 financial institutions in 16 countries, compared with just 16 apps before. It also has 167 different commands that attackers can send remotely. The attack starts with a common trick. The malware pretends to be a legitimate app and asks for VPN permissions through a fake installation screen. It then uses this access to block Google Play Protect while secretly installing the real malware hidden inside the app’s files. Once installed, ToxicPanda abuses Android’s Accessibility Service. This feature is normally used by legitimate tools such as screen readers, but the malware uses it to monitor the victim’s screen and interact with apps and data on the device. The real danger comes from its ability to use Android Debug Bridge (ADB). Once connected, ToxicPanda can run commands through ADB without showing the usual permission requests. This allows it to give itself more permissions, remove Android restrictions on background activity, enable important components without the user knowing, and maintain access to the device. “The malware also introduces an automated click-based mechanism to abuse Android Wireless Debugging (ADB), enabling privilege escalation and shell-level access on compromised devices. Additionally, it can steal lock screen credentials by placing overlays on top of the lock screen.” continues the report. The credential theft itself runs on two separate tracks. For banking and crypto apps specifically, the malware watches which app the victim opens, matches it against a list of 349 targets, and either overlays a fake login screen or deploys an invisible transparent layer to capture every touch and PIN entry directly. Separately, it can now overlay a convincing fake version of the phone’s own lock screen to steal the device PIN, pattern, or password outright, which hands attackers a way back in even after the initial infection window closes. Several capabilities that security firm Cleafy had previously flagged as unfinished in an earlier ToxicPanda variant are now fully working. The malware can automatically click through OEM-specific permission dialogs across Xiaomi, Samsung, Huawei, and other manufacturers’ customized Android builds, request Device Administrator privileges using a fake “system service” prompt, and even remotely force-reset a victim’s lock screen password using legitimate Android device management APIs. It can also load an attacker-controlled webpage inside a full-screen overlay on command, a feature that simply didn’t exist in prior versions. Distribution has shifted too, with samples now getting served from Amazon AWS-hosted storage buckets rather than whatever ad-hoc infrastructure earlier campaigns used. “The updated campaign also reveals a shift in distribution methods, with ToxicPanda 2.0 samples being delivered through Amazon AWS-hosted buckets, indicating the attackers are leveraging cloud infrastructure for malware delivery.” states the report. Using major cloud providers for malware delivery isn’t new, but it does complicate blocking efforts, since flagging an entire AWS IP range as malicious tends to take down a lot of legitimate traffic along with it. None of this requires a sophisticated zero-day, which is honestly the more unsettling part. Every capability here abuses a feature Android ships intentionally, Accessibility Services, Wireless Debugging, Device Administrator APIs, all designed for legitimate accessibility and enterprise device management. “As mobile banking threats like ToxicPanda become increasingly sophisticated, conventional signature-based security layers are no longer sufficient to protect enterprise mobile endpoints.” concludes the report. If you’re responsible for securing mobile endpoints, this is less a “patch something” problem and more a “detect abnormal use of normal features” problem, and that’s a considerably harder thing to build detection around. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ToxicPanda 2.0)
A supply-chain attack targeting Android-based car head units is using a legitimate device-update app to spread malware that enlists compromised devices in a proxy botnet or uses them for ad fraud. Kaspersky researchers analyzed the malware and attributed the operation to the MoYu group, a threat actor previously associated with the BadBox malware botnet. The researchers note that this is the first documented case of a malware infection chain specifically created for the targeted car head unit. MoYu's operation targets systems from DoFun, a Chinese automotive software and hardware provider owned by Shenzhen Driving Control Technology Co., Ltd. DoFun is an automotive software, cloud services, and hardware provider that sells generic Android-based head units, which act as the command center for a car's infotainment, navigation, and settings systems.
Malware is abusing car infotainment updates to install proxy software, turning Android head units into nodes for the BADBOX network. Kaspersky researchers found something in June 2026 that made them stop and look twice: an Android app with no interface at all, installed like any ordinary app but making zero effort to disguise itself as legitimate. Their report documents the first known malware infection targeting car head units, the Android-based infotainment and control systems built into many modern vehicles, spread through the vehicle’s own official update mechanism. Head units run Android for practical reasons, since manufacturers can build on existing source code and add their own custom system apps during production. That flexibility cuts both ways. Because head units are just Android devices under the hood, most apps built for smartphones can technically run on them too, including malware, even though something like a banking trojan would be wasted effort on a device nobody uses for mobile banking. Kaspersky researchers found something unusual in June 2026: an Android app with no visible interface that was installed like a normal app but did not try to look legitimate. Their report describes what they say is the first known malware infection targeting car head units, Android-based systems used for infotainment and vehicle controls, delivered through the car’s official update system. “We identified new Android malware: a multi-stage downloader whose ultimate purpose is ad fraud and creation of a proxy botnet.” reads the report published by Kaspersky. “The malware spread through the built-in updaters of Android-based automotive head unit firmware. This is the first documented case of malware found on a car head unit with an infection chain specific to that type of device.” Car head units often use Android because it is flexible and lets manufacturers add their own software. But this also creates a security risk. Since these systems are basically Android devices, many apps designed for smartphones can also run on them, including malware. The infection chain here starts inside TWCore, a completely legitimate system app responsible for analytics and firmware updates on DoFun head units. An MQTT message broker sends TWCore instructions about which APK files to download and install, and a specific configuration flag called installNotExists controls whether the app checks if something is already installed before pushing it. “TWCore only checks whether an app is already installed on the device when installNotExists = false The APK file is downloaded to <TWCore external cache dir>/push/apk/ for installation.” which means setting that flag the other way turns a routine update channel into a silent installation pipeline for anything the attackers want to push. What gets installed through that channel is a small dropper called JarService, carrying zero user interface and doing nothing but decrypting and loading the next stage. That stage is a loader that phones home to a command server, reports basic device details, and receives a download link for the actual payload, a third-stage module researchers found could be pulled in at least seven different versions simply by trying different version numbers in the download URL. That third stage turns out to be a clicker and reverse proxy component, checking in with its server every 90 minutes by default and waiting for new instructions. “In this stage, the malware sends a POST request to /cpc/api/task every 90 minutes by default, containing information about the infected device (display resolution, device model, the SSID of the connected Wi-Fi network, MAC address, and so on) along with the Trojan’s configuration version.” continues the report. “If the configuration is outdated, the C2 server returns an updated configuration containing new C2 addresses and new paths for sending HTTP requests.” The command system behind the malware is more powerful than you might expect from something running silently on a car’s dashboard. Researchers found nine commands, including ones that can change the clipboard, send HTTP requests, load web pages, and run JavaScript. In practice, attackers mainly used two: one to download and run new code, and another to send web requests. The extra module they deployed, called “zhima,” was a reverse proxy. This means the main goal was not to attack or control the car. Instead, the attackers wanted to use infected cars’ internet connections as part of a larger proxy network. Tracing the malware’s naming conventions and infrastructure led researchers to attribute the campaign, with high confidence, to MoYu Group, an actor connected to the BADBOX botnet that’s been documented previously by other researchers. A thread inside the second-stage loader carried the internal name “mosdk-host-loader,” which pointed toward malware previously found on TV set-top boxes tied to the same group, and overlapping network infrastructure independently spotted by a separate research team around the same time backed up the connection. The command system behind the malware is more powerful than you might expect from something running silently on a car’s dashboard. Researchers found nine commands, including ones that can change the clipboard, send HTTP requests, load web pages, and run JavaScript. In practice, attackers mainly used two: one to download and run new code, and another to send web requests. The extra module they deployed, called “zhima,” was a reverse proxy. This means the main goal was not to attack or control the car. Instead, the attackers wanted to use infected cars’ internet connections as part of a larger proxy network. There is also a strange detail in the network’s infrastructure. The proxy service’s admin panel allows people to create accounts if they have a valid invite code. Its copyright text and login page also look similar to those used by at least two commercial residential-proxy services. This suggests the network may be linked to a business-like proxy service, while also using infected cars to provide internet connections. BADBOX has survived several takedown attempts by researchers and law enforcement. This campaign shows why: the people behind it keep changing how they spread the malware and are moving into new types of devices. Cars are now joining smart TVs and set-top boxes as devices that can be quietly added to a botnet. As cars become more like computers, they also need the same kind of security protection. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Android Car)
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Zimbra Collaboration Suite (ZCS) flaw CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog. CERT Polska, Poland’s national computer emergency response team, confirmed this week that threat actors are actively exploiting the critical vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated remote code execution and was patched less than a month ago. “The CERT Polska team informs about an actively exploited OS Command Injection vulnerability in Zimbra Collaboration Suite.” reads the advisory published by CERT Polska. “The vulnerability, identified as CVE-2026-73570 , allows an unauthenticated attacker to execute arbitrary shell commands with the privileges of the zimbra user . The vulnerability affects instances that have the SNMP trap service enabled via the snmp_notify parameter and the swatchdog service running (enabled by default).” The vulnerability affects systems with SNMP trap notifications enabled and the swatchdog service running, which is enabled by default. The technical root cause is a sanitization failure in the SNMP monitoring component. Zimbra released version 10.1.20 on 20 July 2026 to address the issue. The fix came 28 days before active exploitation was confirmed, which is not a wide window, but apparently wide enough. The attack surface only exists when the optional zimbra-snmp package is installed and SNMP notifications are active, but swatchdog, the service that processes those notifications, is running by default on most installations. Below are recommendations by CERT Polska: “Due to the ongoing campaign exploiting this vulnerability, we recommend: verifying Zimbra logs /var/log/zimbra.log for the following entries: Service status change: <szkodliwy ładunek> changed from stopped to running Service status change: <szkodliwy ładunek> changed from running to stopped verification of files created by user zimbra in the last 30 days in the following directories: /opt/zimbra/jetty/webapps/ /opt/zimbra/jetty_base/webapps/ /tmp/ If you discover any signs of potential exploitation of this vulnerability, please contact our team immediately.” According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaw by August 24, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
The U.S. Department of Justice (DoJ) announced on Friday that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit accusing the company of violating child privacy laws in the country. As part of the settlement, the social media platform will pay $300 million immediately, and an additional $100 million "upon entry of an order vacating a prior consent decree entered against
Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42.
Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's
UMass Amherst researchers showed expired Visa contactless cards can make real purchases by exploiting an unsigned expiry field in Visa’s EMV kernel. Researchers at the University of Massachusetts Amherst demonstrated at USENIX Security 2026 in Baltimore that expired Visa contactless credit cards can complete real purchases, including transactions at live retail and grocery merchants, by exploiting a gap in how the payment protocol handles expiration dates. The paper is titled “Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments,” and the name is accurate. Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza built the attack around a structural weakness in EMV, the contactless payment protocol used by Visa, Mastercard, American Express, and Discover. “A central source of fragility is that the EMV contactless protocol is a selectively authenticated transaction flow. Many data objects are exchanged in plaintext between the card and terminal [2], and only a subset is later bound to cryptographic verification via Offline Data Authentication (ODA) and issuer-verified cryptograms.” reads the paper. “In consequence, an adversary who obtains a man-in-the-middle position on the NFC channel can tamper with decision-critical fields that are consumed by the terminal but are not end-to-end integrity protected. Prior NFC attacks [10–12, 44], including relay-based manin-the-middle techniques, exploit this gap by manipulating transaction-relevant objects in transit while leaving cryptographic checks intact.” The attack exploits a specific design decision in Visa’s Kernel 3, the software layer that implements the EMV protocol for Visa transactions. A Visa contactless transaction presents the expiration date twice: once in a field the payment terminal reads (tag 5F24, the Application Expiration Date) and once in a field the issuing bank reads (tag 57, Track 2 Equivalent Data). These two representations should be tied together by a cryptographic signature, but in Visa’s implementation they aren’t. The relay attack changes only the expiry date that the payment terminal sees, replacing it with a future date while leaving the data sent to the bank unchanged. The card’s digital signature remains valid because it does not cover the expiry date. As a result, the bank receives a transaction that appears legitimate and passes its normal security checks. In simple terms, an attacker can change the expiry date between the card and the terminal without breaking the card’s cryptographic protection. The relay itself is two NFC-capable Android phones running custom software over Wi-Fi: one emulates a card, one emulates a terminal. Each communication round trip added roughly 20 milliseconds for relay alone and about 50 milliseconds with the date modification, keeping the per-transaction average around 415 milliseconds, within Visa’s 500-millisecond command limit. None of the test hardware used EMV’s optional Relay Resistance Protocol, which would have detected the added latency by bounding permissible response times. Mastercard, American Express, and Discover all blocked the attack. Mastercard’s terminal checks consistency between the two expiry representations during record parsing and treats a mismatch as a card data error. American Express binds the expiration date into the data covered by offline authentication, so a modified value produces a hash mismatch. Discover’s kernel wraps the modified transaction objects into the verified transaction hash, and those also failed. Visa’s Kernel 3 does none of these things. The outcome also depended on the issuing bank. The researchers tested three banks with expired and replaced physical Visa cards and found three distinct policies, not a clean pass or fail split. Bank A accepted the modified transactions at $1.00, $100.00, and $500.00 in the lab, and completed purchases of $2.79 at a retail merchant and $3.19 at a grocery merchant on campus. Bank A also accepted transactions from both the expired original card and its replacement against the same account simultaneously, a separate finding that Anwar described as alarming. Bank B detected the modification but still accepted some transactions. A third bank tested on Discover’s kernel detected the edit and declined; however, it also showed the simultaneous-card problem without any modification at all. There is another finding that makes the issue more serious. Researchers changed the Consumer Device Cardholder Verification Method flag at five US banks, and the transactions worked at most of them. This flag controls how the terminal verifies the cardholder, and attackers can change it because the payment data can be modified while it travels between the card and the terminal. There is also another problem with Kernel 3. It sends the issuer a Terminal Verification Results value filled with zeros. This means the bank cannot tell whether the terminal checked the card’s expiry date or whether that check failed. The bank must therefore approve the transaction without seeing what the terminal actually detected. “Across all tests, the dominant factors that determine attack success or failure are: (i) the EMV kernel in use and whether expiry data fields are cryptographically bound to authenticated protocol outputs; (ii) issuer-side lifecycle enforcement, especially whether authorization is tied only to the active account and PAN or also to the specific card instrument and expiration date; and (iii) whether terminal-side validation results are visible to the issuer via TVR. In contrast, transaction amount1 , merchant category, and POS terminal brand did not independently determine the transaction outcome.” continues the paper. The researchers disclosed the findings to Visa in May 2025 and followed up in December 2025. The paper records that Visa acknowledged the report, said it passed initial triage, and indicated it was undergoing reproduction by Visa’s red team. No CVE has been assigned. Neither Visa nor any of the notified banks confirmed any mitigation as of the paper’s acceptance. The Register asked Visa for comment and received no response. The countermeasures the paper proposes sit at the kernel, terminal, and issuer layers: bind the expiry date cryptographically to an issuer-verifiable signature, require terminals to compare both expiry representations and make mismatches visible to the issuer, and have issuers authorize against the PAN-and-expiry combination rather than the PAN alone. For cardholders, the researchers recommend destroying the chip and magnetic stripe of expired cards rather than discarding them intact. Given that the attack requires only the expired physical card or sustained NFC proximity to it, that guidance is now slightly less hypothetical than it was before this paper. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Visa)
Confirm this action.
Leaving now will discard your changes.