Loading story…
New variants of NFCShare are targeting mobile banking customers across Europe through phishing sites and GitHub-hosted fake banking app updates that impersonate legitimate banks. Researchers said the campaign, first seen spoofing Deutsche Bank, has expanded to primarily target banking brands in Italy and Spain, with victims lured into installing malicious APKs after being told to enable apps from unknown sources or follow fake bank update prompts.
Once installed, the malware abuses a phone’s NFC capability to trick victims into scanning their payment cards and entering their PINs, then exfiltrates the stolen card data and PINs to attacker-controlled infrastructure over WebSocket for potential NFC payment relay fraud. Investigators also reported that newer samples are rebuilt rapidly and use malformed APK packaging, including broken ZIP paths, to disrupt automated analysis and slow detection while preserving recognizable behaviors such as combined WebView and NFC activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that newer NFCShare samples use malformed ZIP paths inside APK files to disrupt some automated analysis tools and delay detection. This packaging change was noted as part of the newer wave of samples tied to the expanded campaign.
D3Lab first observed and documented the NFCShare Android malware in January 2026, when it was impersonating Deutsche Bank. The malware targeted banking users by stealing payment card data via NFC and capturing card PINs.
Around 2026-05-14, researchers observed the NFCShare campaign broaden beyond its earlier Deutsche Bank focus to impersonate multiple banking brands, primarily in Italy and Spain. The expansion also included GitHub-hosted fake banking app updates and more rapid APK rebuilding by the operators.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
rhisac.org
Open sourcecybersecuritynews.com
Open sourced3lab.net
Open sourcebleepingcomputer.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified a surge in Android malware that abuses Near Field Communication (NFC) and Host Card Emulation (HCE) features to steal payment data and conduct fraudulent transactions. Since April 2024, over 760 malicious apps have been detected, with campaigns expanding from isolated incidents to a global threat affecting users in Russia, Poland, the Czech Republic, Slovakia, Brazil, and other countries. These apps impersonate trusted financial institutions and government services, including the Central Bank of Russia, Gosuslugi, Santander, and VTB Bank, to deceive users into installing them and setting them as the default payment method. Once installed, the malware activates NFC relay functionality, capturing card data in real time and forwarding it to attacker-controlled servers. The operation is coordinated through more than 70 command-and-control servers and numerous Telegram bots, enabling attackers to use one infected device to collect payment data and another to complete fraudulent transactions at physical terminals. The rapid proliferation and sophistication of these attacks highlight the growing risk to mobile payment systems and the need for increased vigilance among Android users and financial institutions.
Jul 12, 2026
Researchers have identified a surge in Android malware abusing Near-Field Communication (NFC) and Host Card Emulation (HCE) to steal payment data and facilitate unauthorized transactions. Over 760 malicious apps have been discovered targeting banks, payment services, and government portals worldwide, including institutions in Russia, Europe, and Brazil. These apps often impersonate trusted organizations, urging users to set them as default NFC payment handlers, and exfiltrate sensitive EMV card data—such as device IDs, card numbers, and expiry dates—via Telegram channels. Attackers remotely control the apps through command-and-control servers, enabling them to relay card terminal requests, provide PINs, and execute fraudulent transactions with minimal user interaction. The rapid adoption of "Tap-to-Pay" has made NFC a lucrative target, with over 70 C2 servers and dozens of Telegram bots coordinating attacks against more than 20 global institutions since April 2024. CERT Polska has specifically analyzed the NGate malware campaign, which employs NFC relay attacks to enable unauthorized ATM withdrawals using victims’ own payment cards. Victims are lured through phishing messages and social engineering phone calls, convincing them to install a malicious Android app and verify their payment card by tapping it against their phone and entering their PIN. The app captures the NFC exchanges and PIN, relaying this data to an attacker-controlled device at an ATM, allowing criminals to withdraw cash without physical access to the card. The malware registers itself as an HCE payment service and conceals its C2 infrastructure within encrypted assets, complicating detection and response efforts.
Jul 12, 2026
A new malware campaign dubbed **RelayNFC** has been uncovered in Brazil, targeting users through phishing sites that distribute a malicious app masquerading as a payment card security tool. The app, once installed, captures victims' card details and enables attackers to conduct fraudulent transactions by relaying card data in real time, effectively mimicking the physical presence of the card. The malware is notable for its lightweight, evasive design, utilizing a Hermes-compiled payload and a JavaScript engine to remain undetected by security tools, with zero detections reported on VirusTotal at the time of discovery. The campaign reflects a broader trend of NFC-based attacks, with other malware strains such as Ngate and SuperCardX also exploiting NFC capabilities for financial fraud. The use of phishing as the primary distribution method highlights the importance of user vigilance and the need for robust device-level protections. Financial institutions are advised to strengthen monitoring and detection mechanisms to address the evolving threat landscape posed by sophisticated NFC relay malware like RelayNFC.
Jun 29, 2026