Skip to main content
Mallory
Malware

NFCShare

NFCShare is an Android banking trojan/malware family used in phishing campaigns to steal payment card data via NFC. It has been distributed as fake updates for legitimate banking apps, including malicious APKs hosted on GitHub repositories. Researchers reported that victims are first lured to phishing sites impersonating real banks, where they are asked for banking credentials and then prompted to install a supposed banking app update; related lures may also involve SMS messages or phone calls from fake bank representatives, although those were not directly observed in the analyzed cases.

The malware uses social engineering to present a fake verification flow that instructs victims to place a payment card near the phone’s NFC reader and to enter a 4-digit PIN. Technically, it uses Android’s IsoDep interface and EMV commands to read card data from scanned payment cards. Reported stolen data includes the payment card number, card type, expiry date, and the victim-entered PIN. The collected information is exfiltrated to attacker-controlled infrastructure over a WebSocket channel and may be used for NFC payment relay fraud. Reporting linked the abuse pattern to previously documented NGate, SuperCard X, and RelayNFC-style attacks, although D3Lab stated NFCShare has distinct code, libraries, architecture, and implementation details; it may still be part of the same broader criminal ecosystem.

D3Lab first documented NFCShare in January 2026, initially in a Deutsche Bank-themed phishing campaign in Germany. Later campaigns expanded to target customers of multiple banks and financial institutions across Europe, especially banks in Italy and Spain. One observed GitHub repository created on April 10 hosted 56 unique APKs impersonating banking apps, including names such as Intesa Carte.apk, Sella Carte.apk, Banca Sella Carte.apk, Nexi Carte.apk, Fideuram Carte.apk, Mooney Carte.apk, CaixaBank.apk, CaixaBankNfc.apk, and CaixaReactivaTarjeta.apk.

Newer NFCShare samples introduced malformed APK packaging intended to hinder automated analysis and possibly some security tools. The APKs remain ZIP archives but contain poisoned or malformed internal file paths that can cause some extraction tools to mis-handle paths and error out, though this does not prevent manual analysis or code recovery.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566PhishingEvidence2

Recent NFCShare attacks observed starting May 14 begin with the victim visiting a phishing site that impersonates a real bank and asks for banking credentials.

T1566.003Spearphishing via ServiceEvidence1

Victims are then urged to update their banking app and are redirected to a GitHub repository hosting a malicious APK file.

Stealth

2 techniques
T1027Obfuscated Files or InformationEvidence1

One interesting aspect of the new version of the malware is the introduction of malformed APK packaging to hinder automated analysis, and potentially also security tools.

T1036MasqueradingEvidence1

New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on GitHub.

Credential Access

2 techniques
T1056Input CaptureEvidence1

The malware steals the card number, type, expiry date, and a 4-digit PIN entered by the victim under the pretense of a security step

T1649Steal or Forge Authentication CertificatesEvidence1

Recent NFCShare attacks observed starting May 14 begin with the victim visiting a phishing site that impersonates a real bank and asks for banking credentials.

Collection

2 techniques
T1005Data from Local SystemEvidence1

After tricking victims with a fake verification screen to place the cards near the mobile device's near-field communication (NFC) chip, NFCShare reads the information using Android’s IsoDep interface and EMV commands.

T1056Input CaptureEvidence1

The malware steals the card number, type, expiry date, and a 4-digit PIN entered by the victim under the pretense of a security step

Command and Control

1 technique
T1071Application Layer ProtocolEvidence1

The malware steals the card number, type, expiry date, and a 4-digit PIN entered by the victim under the pretense of a security step, and exfiltrates it to the attacker’s command-and-control (C2) host over a WebSocket channel.

Exfiltration

1 technique
T1567Exfiltration Over Web ServiceEvidence1

The malware steals the card number, type, expiry date, and a 4-digit PIN entered by the victim under the pretense of a security step, and exfiltrates it to the attacker’s command-and-control (C2) host over a WebSocket channel.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.