New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on GitHub, according to BleepingComputer, citing research by D3Lab. The campaign now targets customers of multiple banks and financial institutions across Europe, mainly in Italy and Spain, with the aim of stealing payment card data.
How the trick works. After a fake verification screen persuades victims to hold their card near the phone's NFC chip, NFCShare reads the card using Android's IsoDep interface and EMV commands. It grabs the card number, type and expiry date, plus a 4-digit PIN that the victim types in as a supposed security step. The data is then sent to the attacker's command-and-control server over a WebSocket channel.
From phishing site to APK. Attacks observed since May 14 start with a phishing site that impersonates a real bank and asks for banking credentials. Victims are then urged to update their banking app and redirected to a GitHub repository hosting a malicious APK file. D3Lab notes that SMS messages or calls from fake bank staff may also be used, as in similar attacks, although its researchers did not observe this directly.
56 fake apps. Since it was created on April 10, the GitHub repository has hosted 56 unique APKs impersonating banking apps, with names such as Intesa Carte, Banca Sella Carte, Nexi Carte, Fideuram Carte, Mooney Carte, CaixaBank, CaixaBankNfc and CaixaReactivaTarjeta. When D3Lab first documented NFCShare in January 2026, it targeted only Deutsche Bank in Germany, suggesting the scope has widened.
Harder to analyse. The new version uses malformed APK packaging, with poisoned file paths inside the ZIP archive that make some extraction tools throw errors. According to D3Lab, this does not prevent manual analysis, but it does disrupt static analysis in certain tools and potentially some security products.
Why it matters
Fuel for relay fraud. Card data stolen this way can be used in NFC payment relay schemes, like those documented in the NGate, SuperCard X and RelayNFC attacks. D3Lab researcher Andrea Draghetti told BleepingComputer that NFCShare uses distinct code, libraries and architecture from those families, but could still be an evolution of the same ecosystem driven by the same threat actors.
- Install banking apps only from Google Play, never from links or code repositories.
- Keep Google Play Protect enabled.
- Be wary of any verification request that asks you to tap your card on your phone.
- Never type your card PIN into an app as a security check.
- If a message or call pushes you to update your bank app, contact your bank through its official channels.
Source: BleepingComputer
Leave a Reply