A sophisticated Android malware campaign is turning victims' smartphones into fraudulent payment terminals, allowing attackers to steal contactless card data in real time while simultaneously taking out loans in the victims' names.