SuperCard X
SuperCard X is an Android NFC relay malware family and malware-as-a-service (MaaS) offering used to facilitate fraudulent contactless transactions. Public reporting cited in the content describes it as a barebones MaaS kit disguised as a legitimate NFC application that captures payment card data and relays it in real time for tap-to-pay fraud. It has been documented as part of the broader wave of Android NFC relay threats alongside families such as NGate, ZNFC, RelayNFC, and PhantomCard.
The malware is associated with NFC-based payment fraud workflows in which victims are socially engineered into installing a malicious Android app, granting NFC access, and tapping their payment card to the device. The captured card data is then relayed to attacker-controlled infrastructure or a second device to emulate the victim’s card at a point-of-sale terminal or ATM. Reporting in the provided content also places SuperCard X in the category of malware used for NFC theft and relay schemes enabling fraudulent contactless transactions.
According to the content, SuperCard X was uncovered in early 2025 in Italy. Additional attempted deployments were reportedly recorded in Russia in May 2025 and Brazil in August 2025. It is referenced in threat reporting covering Android tap-to-pay fraud growth from August 2024 through August 2025 and in ESET and Recorded Future reporting as an example of the rise in NFC relay malware and MaaS platforms supporting contactless payment fraud.
High-confidence details in the provided material do not include specific package names, infrastructure indicators, or code-level IOCs for SuperCard X itself.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as Android malware involved in NFC payment relay schemes used to abuse stolen payment card data.
Previously documented Android NFC relay malware family referenced for comparison; noted as using an early and more detectable HCE approach with explicit financial AIDs declared in hce.xml.
Referenced as an NFC relay malware family; NFCShare C2 was previously flagged as associated with SuperCard X activity (Nov 2025).
Android malware-as-a-service enabling NFC relay attacks for contactless ATM/PoS fraud; campaign noted targeting Italy.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.