NFCShare Android malware spread via fake banking app update on GitHub

A brand new variant of NFCShare Android malware is being distributed as a faux replace to a reputable banking app hosted on GitHub.

The malware has advanced and is now focusing on clients of a number of banks and monetary establishments throughout Europe with a phishing marketing campaign aimed toward stealing cost card knowledge.

As soon as the sufferer is tricked with a faux affirmation display and the cardboard is positioned close to the cellular system’s Close to Subject Communication (NFC) chip, NFCShare makes use of Android’s IsoDep interface and EMV instructions to learn the data.

The malware steals the cardboard quantity, kind, expiration date, and four-digit PIN entered by the sufferer underneath the guise of safety procedures and leaks it to the attacker’s command and management (C2) host by way of a WebSocket channel.

Data collected on this method can be utilized in NFC cost relay schemes, as documented within the NGate, SuperCard X, and RelayNFC malware assaults.

NFCShare was first documented in January 2026 by researchers at D3Lab, who’ve been monitoring its exercise and evolution.

D3Lab researcher Andrea Draghetti informed BleepingComputer that regardless of similarities to different Android malware that exploits NFC chips to steal knowledge, NFCShare makes use of totally different code, libraries, structure, and implementation particulars.

Nonetheless, Draghetti famous that this might nonetheless be an evolution of the identical ecosystem pushed by the identical risk actors.

A latest NFCShare assault noticed since Might 14 begins with a sufferer visiting a phishing web site impersonating an actual financial institution and requesting banking credentials.

Victims are then prompted to replace their banking app and redirected to a GitHub repository internet hosting the malicious APK file.

The researchers observe that SMS messages and telephone calls from faux financial institution representatives can be used as a part of the social engineering course of, as seen in comparable assaults, though the D3Lab researchers haven’t immediately noticed these strategies.

Since its creation on April 10, the GitHub repository used to distribute NFCShare has hosted 56 distinctive APKs masquerading as cellular apps from primarily Italian and Spanish banks.

• IntesaCarte.apk
• Seal chart.apk
• Banca Sella Carte.apk
• nexicalte.apk
• Fideuram medical document.apk
• moony medical document.apk
• Caixa Financial institution.apk
• Caixa Financial institution Nfc.apk
• CaixaReactivaTarjeta.apk

D3Lab reported in January that the malware solely focused Germany’s Deutsche Financial institution, which can point out a broader goal.

One attention-grabbing factor in regards to the new model of this malware is that it introduces a rogue APK package deal that forestalls automated evaluation and, in some circumstances, safety instruments as effectively.

APKs are nonetheless ZIP archives, however the brand new samples include tainted/malformed file paths inside that ZIP, inflicting some extraction instruments to incorrectly interpret inside relative paths as file system paths, inflicting errors.

Nonetheless, D3Lab factors out that this trick doesn’t stop guide evaluation or code restoration. Somewhat, it breaks static evaluation in sure instruments.

Android customers are suggested to solely get their banking apps from Google Play, allow Play Shield, and be cautious of “affirmation requests” that immediate them to scan their NFC playing cards.