Full Report
New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on GitHub. [...]
Analysis Summary
This report provides a summary of the NFCShare malware based on the provided intelligence from researchers at D3Lab.
# Tool/Technique: NFCShare (Android Malware)
## Overview
NFCShare is a specialized Android malware variant first identified in January 2026. Its primary purpose is to exfiltrate payment card data from physical cards using the mobile device's Near-Field Communication (NFC) chip. It employs social engineering to trick users into scanning their credit/debit cards, subsequently facilitating NFC payment relay fraud.
## Technical Details
- **Type:** Malware Family (Mobile Trojan / NFC Stealer)
- **Platform:** Android
- **Capabilities:** NFC data harvesting (ISO-DEP/EMV), PII exfiltration, Anti-analysis (Malformed ZIP/APK packaging), Social Engineering.
- **First Seen:** January 2026
## MITRE ATT&CK Mapping
- **[TA0031 - Network Effects]**
- **[T1644 - Adversary-in-the-Middle]** (Used for relaying NFC traffic)
- **[TA0037 - Collection]**
- **[T1421 - Input Capture]** (Capturing 4-digit PIN via fake UI)
- **[T1645 - Stolen Signal]** (Harvesting NFC card data)
- **[TA0041 - Impact]**
- **[T1451 - Financial Theft]**
- **[TA0001 - Initial Access]**
- **[T1474 - Supply Chain Compromise]** (Abusing GitHub as a distribution platform)
- **[T1566 - Phishing]**
## Functionality
### Core Capabilities
- **EMV Data Capture:** Uses the Android `IsoDep` interface to send EMV commands directly to a physical card placed near the device. Captures card number, type, and expiry date.
- **PIN Capture:** Displays a fake "security verification" screen to trick the user into manually entering their 4-digit card PIN.
- **Real-time Exfiltration:** Transmits stolen data and PINs to a command-and-control (C2) server via the WebSocket protocol.
- **Geographic Targeting:** Specifically localized to impersonate banks in Italy, Spain, and Germany (e.g., Intesa, CaixaBank, Deutsche Bank).
### Advanced Features
- **Anti-Analysis Packaging:** Uses malformed APK/ZIP file paths. While the archive remains functional for Android's installer, the corrupted paths trigger errors in automated sandbox/static analysis tools.
- **Cloud-Based Distribution:** Leverages GitHub repositories to host malicious APKs, masquerading as legitimate banking app updates to bypass common reputation-based filters.
## Indicators of Compromise
- **File Names:**
- `Intesa Carte.apk`
- `Sella Carte.apk`
- `Banca Sella Carte.apk`
- `Nexi Carte.apk`
- `Fideuram Carte.apk`
- `Mooney Carte.apk`
- `CaixaBank.apk`
- `CaixaBankNfc.apk`
- `CaixaReactivaTarjeta.apk`
- **Network Indicators:**
- WebSocket connections to adversarial C2 infrastructure (Note: Specific URLs should be identified via D3Lab's technical report).
- **Behavioral Indicators:**
- Unsolicited requests for the user to enable NFC or place a card against the phone.
- Apps requesting `NFC` permissions that are downloaded from non-standard sources.
## Associated Threat Actors
- While distinct codebases are used, researchers suggest these campaigns are part of the same ecosystem as actors deploying **NGate**, **SuperCard X**, and **RelayNFC**.
## Detection Methods
- **Signature-based:** Security vendors should update definitions for known NFCShare APK hashes hosted on GitHub.
- **Behavioral:** Identify apps utilizing `android.permission.NFC` that were not installed via the Google Play Store.
- **Static Analysis:** Analysts must use tools capable of handling malformed ZIP structures (e.g., low-level hex editors or updated extraction libraries) to prevent path-traversal/extraction errors.
## Mitigation Strategies
- **Distributor Integrity:** Only source financial applications from the official Google Play Store.
- **System Protection:** Ensure "Google Play Protect" is enabled and active on all Android devices.
- **User Education:** Train users to never scan physical payment cards against their phone unless using an officially verified, first-party payment setup (e.g., Google Pay).
- **Hardening:** Disable NFC on mobile devices when not in active use.
## Related Tools/Techniques
- **NGate:** Similar NFC-stealing malware.
- **SuperCard X:** Shared TTPs involving NFC relay schemes.
- **RelayNFC:** Malware used in broader European payment card relay attacks.