NFCShare Android Malware Targets European Bank Customers via Fake GitHub Updates
Summary
NFCShare is reportedly distributed as fake banking-app updates on GitHub, stealing card details and PINs through NFC prompts from customers of banks across Europe. New APK packaging reportedly disrupts some automated analysis tools.
Key points
- Fake banking-app updates hosted on GitHub distribute NFCShare to targets of banks and financial institutions across Europe.
- A phishing site impersonating a bank prompts victims to update their app and redirects them to a malicious APK.
- The malware uses Android’s IsoDep interface and EMV commands to read card details after prompting victims to scan a card and enter a PIN.
- Stolen card data and PINs are sent to an attacker-controlled C2 host over WebSocket for potential use in NFC payment relay schemes.
- D3Lab reported that newer samples use malformed paths inside APK archives to disrupt static analysis in some tools; the technique does not prevent manual analysis.
- The article advises Android users to install banking apps only from Google Play, enable Play Protect, and be wary of NFC card verification requests.
- D3Lab did not directly observe SMS messages or calls from fake bank representatives in these attacks; researchers say such tactics may be used in similar attacks.
Article Details
- Event Type
- Phishing campaign distributing NFCShare Android malware through fake banking-app updates hosted on GitHub.
- Impact
- NFCShare tricks victims into scanning payment cards and entering a PIN, then exfiltrates card details and PIN to a C2 host. The stolen information can be used in NFC payment relay fraud. The campaign targets customers of banks and financial institutions across Europe.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelNFCShare exfiltrates stolen card information and PIN to its C2 host over a WebSocket channel.T1204.002 · Malicious FileVictims are redirected to a GitHub repository and urged to install a malicious APK disguised as a banking-app update.T1566 · PhishingThe campaign begins with a phishing site impersonating a real bank and requesting banking credentials.
People
Malware
NFCShareNFCShare Android malware is being spread through fake banking app updates on GitHub and now targets customers of multiple banks across Europe to steal payment card data.NGateThe information collected this way can then be used in NFC payment relay schemes, as documented in the NGate, SuperCard X, and RelayNFC malware attacks.RelayNFCThe information collected this way can then be used in NFC payment relay schemes, as documented in the NGate, SuperCard X, and RelayNFC malware attacks.SuperCardXThe information collected this way can then be used in NFC payment relay schemes, as documented in the NGate, SuperCard X, and RelayNFC malware attacks.
Products
AndroidNFCShare Android malware is being spread through fake banking app updates on GitHub and now targets customers of multiple banks across Europe to steal payment card data.GitHubNFCShare Android malware is being spread through fake banking app updates on GitHub and now targets customers of multiple banks across Europe to steal payment card data.
Countries
GermanyIn January, D3Lab reported that the malware targeted only Deutsche Bank in Germany, which may suggest an extended targeting scope.ItalySince its creation on April 10, the GitHub repository used for distributing NFCShare has hosted 56 unique APKs that impersonated mobile apps for banks primarily from Italy and Spain:SpainSince its creation on April 10, the GitHub repository used for distributing NFCShare has hosted 56 unique APKs that impersonated mobile apps for banks primarily from Italy and Spain: