PhantomCard
PhantomCard is an Android NFC-relay banking trojan first identified by ThreatFabric. It is described as a China-origin NFC relay malware-as-a-service variant primarily targeting banking customers in Brazil, with reporting indicating it may be adaptable to other regions and potentially expand globally. The malware has been distributed via fake Google Play pages and masqueraded as a card-protection application named “Proteção Cartões” (“Card Protection”), including fabricated positive reviews to lure victims.
PhantomCard abuses near-field communication to conduct relay attacks against contactless payment cards, specifically EMV cards using ISO-DEP (ISO 14443-4) communications. It instructs victims to tap their payment card against the infected Android device and then prompts them to enter a 4-digit or 6-digit PIN. After detecting the card, the malware prepares and relays NFC card data through attacker-controlled infrastructure, establishing a communication channel between the victim’s physical card and a POS terminal or ATM near the fraudster, enabling fraudulent payments or cash-outs. Reported implementation details include use of the scuba_smartcards library for parsing payment-card data and the APDU command 00A404000E325041592E5359532E444446303100 to select the EMV Payment System Environment directory 2PAY.SYS.DDF01. Reporting also states the criminal operation requires a separate mule-side application to receive relayed data and communicate with the POS terminal.
ThreatFabric assessed that the actor advertising the malware as “Go1ano developer” was likely a reseller rather than the original developer. Supporting evidence included multiple Chinese debug strings in the code and references to “NFU Pay,” a Telegram-promoted NFC relay MaaS platform. ThreatFabric concluded that Go1ano developer likely purchased a customized version from NFU Pay and resold it. The malware’s C2 included an endpoint path “/baxi/b,” noted as corresponding to “Brazil” in Chinese, supporting assessment that the observed variant was tailored for the Brazilian market. Additional reporting places PhantomCard among a broader wave of NFC-enabled Android fraud tooling documented from 2024 to 2025.
High-confidence indicators of compromise reported by ThreatFabric include Android package com.nfupay.s145 with SHA-256 a78ab0c38fc97406727e48f0eb5a803b1edb9da4a39e613f013b3c5b4736262f, and package com.rc888.baxi.English with SHA-256 cb10953f39723427d697d06550fae2a330d7fff8fc42e034821e4a4c55f5a667.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In this report we introduce PhantomCard - a new Android NFC-based Trojan targeting banking customers in Brazil and potentially expanding globally.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
1 technique
Execution
Stealth
1 technique
Stealth
Credential Access
2 techniques
Credential Access
Collection
1 technique
Collection
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Android trojan and NFC relay malware-as-a-service variant that enables relay attacks by capturing NFC data from victims' banking cards and relaying it to attackers for fraudulent POS or ATM transactions.
Troyano para Android que habilita ataques de retransmisión NFC al capturar datos NFC de tarjetas bancarias y retransmitirlos al dispositivo del atacante para realizar transacciones fraudulentas en POS o cajeros automáticos.
Referenced as an example NFC relay malware family similar to NFCShare (no additional behavior details provided in the content).
Android trojan enabling NFC relay fraud for banking transactions; targets Brazilian banking customers (per summary).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.