Loading malware…
ZNFC is an Android NFC relay malware family used in tap-to-pay fraud operations. It is designed to relay legitimate near-field communication payment data from a device under an attacker’s control to a remote accomplice, enabling fraudulent contactless transactions as part of so-called Ghost Tap schemes. In these operations, attackers first obtain victim payment-card data and one-time authentication codes through smishing and phishing workflows, provision the stolen cards into attacker-controlled mobile wallets, and then use NFC relay tooling to monetize the cards at point-of-sale terminals.
ZNFC has been documented alongside other commercialized NFC relay malware families such as NGate, SuperCard X, and PhantomCard, reflecting the emergence of a broader criminal ecosystem focused on mobile-wallet abuse and remote tap-to-pay fraud. Reporting links its use to tradecraft associated with the China-linked Smishing Triad, a financially motivated threat actor cluster known for harvesting payment-card details through brand impersonation campaigns and converting stolen cards into Apple Pay or Google Pay wallets for cash-out. ZNFC has been described as a paid criminal service marketed online with ongoing operator support, indicating a malware-as-a-service style model that lowers the barrier to entry for fraud actors.
The malware’s role is post-compromise monetization rather than initial intrusion. Its effectiveness depends on prior theft of card data and successful wallet provisioning, after which it supports remote relay of NFC payment signals over the internet to facilitate fraudulent purchases. High-confidence reporting supports Android as the relevant platform for the wallet-side malicious application.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Jednou z možností realizácie tohto útoku je škodlivá aplikácia ZNFC, ktorú má útočník nainštalovanú v telefóne s peňaženkou s ukradnutými kartami.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an example NFC relay malware family similar to NFCShare (no additional behavior details provided in the content).
ZNFC is a tap-to-pay malware application used to steal funds via malicious NFC-based transactions.
Malicious Android application used to relay legitimate NFC payment signals over the internet from a phone containing stolen wallet cards to remote accomplice devices at payment terminals, enabling Ghost Tap cash-out fraud.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.