🌅 Tekin Morning May 3: NGate Malware, iOS Bug, Chrome Zero-Day & Nvidia

🔒 1. NGate Malware: NFC Bank Card Theft via Mobile — The Contactless Heist

Our first story today is a critical security warning. NGate malware — a new iteration of a known malware family — can now transfer NFC data from your bank card through your phone to an attacker's device, enabling them to make contactless ATM withdrawals or unauthorized payments without any physical contact with your card. This attack is so sophisticated that victims don't even realize their card is being used!

According to security researchers at The Hacker News, NGate represents a significant evolution in mobile banking fraud. Unlike traditional card skimming that requires physical access to your card, NGate exploits the NFC (Near Field Communication) technology built into modern smartphones. The malware acts as a relay, capturing card data when you tap your card near your infected phone — perhaps to make a legitimate payment — and then transmitting that data to criminals who can use it anywhere in the world.

The critical point here: this attack doesn't require physical access to your card. You only need to tap your card near your infected phone once — perhaps for a legitimate payment — and the malware copies the data. After that, the attacker can use their phone as if they have your physical card, making ATM withdrawals or contactless purchases. The attack works because NFC technology, while convenient, broadcasts card data that can be intercepted and replayed.

What makes NGate particularly dangerous is its stealth. Unlike traditional card fraud where you might notice suspicious charges immediately, NGate attacks often go undetected for days or weeks. The malware is designed to avoid triggering fraud detection systems by making small, seemingly legitimate transactions. By the time victims notice, attackers have already moved on to new targets.

🍎 2. Apple iOS Bug: Deleted Notifications Remain on Device

Apple has patched a security flaw in the Notification Services of iOS and iPadOS that could compromise user privacy. The problem? When you deleted a notification — such as a private message or banking alert — it would disappear from your screen but remain stored on the device. This means if someone gained access to your phone, they could potentially view notifications you thought were deleted!

This bug is particularly concerning for users who share their devices with family members or colleagues. Imagine deleting a sensitive message, only to have it accessible through forensic tools or even simple device access. The vulnerability affected all recent versions of iOS and iPadOS prior to the latest update, meaning millions of devices were potentially at risk.

What types of notifications were at risk? Everything from two-factor authentication codes to banking alerts, private messages, health information, and location data. Essentially, any notification you received and then deleted could potentially be recovered by someone with physical access to your device. This is especially problematic in scenarios like:

• Domestic situations: Where partners or family members might access your device
• Workplace environments: Where colleagues might temporarily use your device
• Device theft or loss: Where criminals could extract sensitive information
• Border crossings: Where authorities might examine your device

🌐 3. Google Chrome Zero-Day: First Critical Vulnerability of 2026

Google has released an emergency update for Chrome browser to patch a high-severity zero-day vulnerability that has been exploited in real-world attacks. This marks the first zero-day of 2026 that Google has confirmed is being used in wild attacks — meaning hackers were exploiting this bug before Google could release a patch.

According to BleepingComputer, the vulnerability was discovered by security researchers who observed active exploitation in targeted attacks. While Google hasn't disclosed the technical details of the flaw — a standard practice for zero-days to prevent giving attackers more information — they've confirmed it's a memory corruption issue that could allow attackers to execute arbitrary code on victims' systems.

The increasing trend of Chrome zero-days is concerning. From 8 in 2023 to 14 in 2025, we're seeing a 75% increase over two years. This suggests that either attackers are getting better at finding vulnerabilities, or Chrome's codebase is becoming more complex and harder to secure. Likely, it's both. As Chrome adds more features — from AI integration to advanced web APIs — the attack surface expands.

Google hasn't disclosed the exact details of the vulnerability — this is standard practice for zero-days to prevent giving attackers more information. However, they've confirmed that the bug was used in targeted attacks, suggesting it was likely deployed by sophisticated threat actors, possibly nation-state groups or advanced cybercriminal organizations. The update is rolling out automatically, but users can manually check: Settings → About Chrome.

💰 4. Fake Crypto Apps in App Store: Private Key Theft

A new wave of malicious crypto apps has infiltrated the Apple App Store, masquerading as popular cryptocurrency wallets — but they're actually designed to steal recovery phrases and private keys. These apps are so professionally crafted that they bypassed Apple's review system and made it into the App Store!

According to SecurityWeek, dozens of these malicious apps have been identified, targeting users of popular wallets like MetaMask, Trust Wallet, and Coinbase. The scam is sophisticated: the fake apps look nearly identical to the real ones, with similar names, icons, and user interfaces. Users who download these apps and enter their recovery phrases or private keys unknowingly hand over complete access to their crypto holdings.

The critical point: if you've entered your recovery phrase or private key into an app that you later discovered was fake, immediately transfer your assets to a new wallet. Attackers often wait hours or days before draining wallets to avoid suspicion. The $18M stolen in Q1 2026 represents only reported cases — the actual figure is likely much higher, as many victims are too embarrassed to report losses or don't realize they've been scammed until it's too late.

What makes these scams particularly effective is their sophistication. The fake apps often include:

• Realistic UI/UX: Pixel-perfect copies of legitimate apps
• Fake Reviews: Hundreds of positive reviews from bot accounts
• Similar Names: "MetaMask Wallet" instead of "MetaMask"
• Professional Support: Fake customer service that responds quickly
• Delayed Theft: Apps work normally for days before stealing funds

🎮 5. Nvidia vs Gamers: GeForce Crisis and AI Priority

Nvidia is facing a massive backlash from the gaming community as the company continues to prioritize AI data center chips over consumer GeForce GPUs. Gamers who have been loyal to Nvidia for decades are now feeling abandoned as GPU prices skyrocket, availability plummets, and the company's focus shifts entirely to enterprise AI customers.

According to Tom's Hardware, Nvidia's latest earnings report revealed that data center revenue now accounts for 87% of total revenue — up from 53% just two years ago. Meanwhile, gaming GPU revenue has dropped to just 9% of total revenue. This dramatic shift has real-world consequences: the RTX 5090, Nvidia's flagship gaming GPU, has been out of stock for months, with scalpers selling units for 3x MSRP.

The numbers tell a brutal story. In 2022, gaming GPUs generated $9.1 billion in revenue for Nvidia. In 2026, despite the company's total revenue tripling, gaming GPU revenue has actually declined to $8.6 billion. This isn't because gamers stopped buying GPUs — it's because Nvidia stopped making them in sufficient quantities. The company has redirected its manufacturing capacity to AI chips like the H100 and H200, which sell for $30,000-$40,000 each compared to $1,599 for an RTX 5090.

But here's where it gets complicated. Nvidia built its empire on the backs of gamers. For 25 years, gamers were Nvidia's core customer base, driving innovation and providing steady revenue through GPU upgrade cycles. Now, those same gamers feel betrayed. Social media is flooded with posts from longtime Nvidia fans switching to AMD or Intel, not because the competition is better, but because they can actually buy AMD and Intel GPUs.

The situation has created an opening for AMD and Intel. AMD's Radeon RX 8900 XT, while not quite as powerful as the RTX 5090, is actually available and costs $1,299. Intel's Arc B770, positioned as a mid-range option, has seen sales surge 340% year-over-year. Gamers aren't necessarily choosing these cards because they're better — they're choosing them because they exist.

Nvidia's CEO Jensen Huang addressed the controversy in a recent earnings call, stating: "Gaming remains important to us, but we must allocate resources where demand is strongest. AI is transforming every industry, and we have a responsibility to our customers and shareholders to meet that demand." Translation: gamers are no longer the priority.

📱 6. Apple Visual Intelligence in iOS 27: AI Photo Editing Revolution

Apple has unveiled Visual Intelligence, a groundbreaking AI-powered photo editing system coming to iOS 27 this fall. This isn't just another filter or adjustment tool — it's a complete reimagining of how we interact with photos, using on-device AI to understand image content and make intelligent editing decisions in real-time.

According to Apple's announcement at WWDC 2026, Visual Intelligence uses a combination of on-device neural engines and Apple's proprietary image models to analyze photos and suggest edits, remove unwanted objects, enhance lighting, and even generate missing parts of images — all without sending data to the cloud. This is Apple's answer to Google's Magic Eraser and Samsung's Generative Edit, but with a focus on privacy and speed.

What makes Visual Intelligence different from competitors is its on-device processing. While Google's Magic Eraser and Samsung's Generative Edit send photos to the cloud for processing, Apple runs everything locally on the iPhone's Neural Engine. This means faster processing, better privacy, and the ability to edit photos even without an internet connection.

The hardware requirements are significant. Visual Intelligence requires an A17 Pro chip or newer, which means iPhone 15 Pro, iPhone 16 series, and iPad Pro with M2 or later. Older devices won't support it — not because Apple wants to force upgrades (though that's a nice side effect), but because the AI models genuinely require the Neural Engine's processing power. Running these models on older chips would result in 10-15 second processing times, which defeats the purpose of real-time editing.

The comparison reveals Apple's strategy: prioritize speed and privacy over compatibility. Google and Samsung's cloud-based approaches work on older devices, but they're slower and require internet connectivity. Apple's on-device approach is faster and more private, but only works on newer hardware. It's a classic Apple trade-off: better experience for those who can afford the latest devices.