Apple Pay Express Transit relay → high-value contactless fraud

§ Context

Assumed environment: target victim uses Apple Pay with Express Transit enabled and Visa as default. Affected combination predates 2022 fixes; useful for replay-attack labs and OEM regression testing.

§ Steps

1. 01
   Goods / cash-out launderingExfiltration

   T1041— Exfiltration Over C2 Channel
2. 02
   Other end at attacker-controlled terminalInitial Access

   T1078— Valid Accounts
3. 03
   Position attacker device near victim walletInitial Access

   SE-PRETEXT— Pretexting
4. 04
   Issue high-value transactionLateral Movement

   NFC-APPLE-PAY-RELAY— Apple Pay Express Transit Relay
5. 05
   Stand up NFC relay (proxmark / phone)Lateral Movement

   NFC-EMV-RELAY— Generic EMV Contactless Relay
6. 06
   Set TTQ bit to claim CVM performedImpact

   NFC-LIMIT-BYPASS— Contactless Limit Bypass

§ References

• T1041Exfiltration Over C2 Channel
• T1078Valid Accounts

§ Frequently asked

What is the "Apple Pay Express Transit relay → high-value contactless fraud" attack path?

Specific configuration (Express Transit + Visa) allowed contactless transactions over £1k without unlock or per-tx auth. Two devices relayed the wallet from victim's pocket to a real terminal. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Goods / cash-out laundering (T1041) — a exfiltration primitive. Assumed environment: target victim uses Apple Pay with Express Transit enabled and Visa as default.

What is the final impact of this kill-chain?

The final step lands on Set TTQ bit to claim CVM performed (NFC-LIMIT-BYPASS), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  Vesting beneficiary replace → silently drain stream

  Bug in a custom vesting contract allows anyone to call setBeneficiary on existing schedules. Replace beneficiary with attacker address; legitimate token stream now flows to attacker until released funds are noticed.

• Shared techniques2

  Mass SMS phish → Okta-style portal → SaaS sprawl (0ktapus)

  Wide SMS phishing campaign targeting employees of ~130 organisations with a single phishlet that captures Okta credentials + push approval. Mass automated logins to Twilio, MailChimp, DoorDash et al.

• Shared techniques2

  ERC-4626 first-depositor inflation → drain new deposits

  Be the first depositor with 1 wei → mint 1 share. Send tokens directly to the vault to inflate share price. Every subsequent depositor's amount, integer-divided by the inflated rate, rounds to zero shares.

• Shared techniques2

  Insider admin panel coercion → mass account takeover (Twitter 2020)

  Identify employees with access to an internal admin panel. SE / coerce one to use the panel to change target accounts' email + 2FA, then take them over.

• Shared techniques2

  SAML signature wrapping (XSW) → impersonate admin

  Capture a legitimate SAML response. Re-arrange the XML so the IdP's signature still validates against the original assertion, but the SP parses an attacker-injected assertion claiming Admin.

• Shared techniques2

  MEV bot honeypot → drain searcher

  Plant a transaction that looks like easy arbitrage in the public mempool. The MEV searcher bot front-runs into a trap contract whose 'profit' function reverts and seizes the searcher's gas + funds.