NFCShare Android Malware Hides in Fake Banking Apps

Key Takeaways

• NFCShare, an Android banking trojan, is actively being distributed through fake banking applications, primarily targeting users in Europe.
• The malware leverages a device’s Near Field Communication (NFC) capabilities to steal payment card data and PINs from unsuspecting victims.
• The campaign has evolved significantly, now impersonating multiple European banks and employing sophisticated evasion tactics, including hosting malicious payloads on GitHub disguised as school projects.
• Initial detection of NFCShare occurred in January 2026, with a notable expansion and refinement of tactics observed since May 14, 2026.

Evolved NFCShare Android Malware Targets European Banking Customers

A sophisticated Android malware, identified as NFCShare, is currently being disseminated through deceptive banking applications, posing a substantial threat to mobile users across Europe. This malware is engineered to illicitly acquire payment card details by exploiting a smartphone’s NFC chip. Researchers note a significant escalation in the scope and coordination of this campaign since its initial discovery.

The Modus Operandi of NFCShare

NFCShare first emerged in January 2026, initially observed impersonating Deutsche Bank. The malware’s core functionality involves presenting a fraudulent card-verification screen to victims. This screen prompts users to position their payment card near their device, allowing the malware to capture sensitive card data via NFC. This stolen information, including the card number, type, label, and expiry date, is then transmitted to an attacker-controlled server. Crucially, the malware also intercepts the card’s Personal Identification Number (PIN) before the victim becomes aware of the compromise.

Analysts at d3Lab have meticulously tracked NFCShare’s evolution, observing a marked shift in its operations around May 14, 2026. The expanded campaign now targets a broader spectrum of Italian and European financial institutions, including prominent names such as Intesa Sanpaolo, Banca Sella, Fideuram, Nexi, Mooney, BCC Roma, and Spanish banks like CaixaBank.

While the fundamental attack methodology remains consistent, the operational sophistication behind the campaign has notably increased. According to d3Lab’s report shared with Cyber Security News (CSN), the threat actors are frequently rotating the banking brands they impersonate, rapidly generating new malicious Android Package Kits (APKs), and hosting these payloads on public GitHub repositories camouflaged as academic projects. This strategic agility makes detection and takedown efforts considerably more challenging.

Phishing Tactics and Payload Delivery

Victims are typically lured to the malicious applications via convincing phishing websites that meticulously mimic legitimate banking portals. After users input their login credentials on these fake sites, they are informed that their banking application requires an update. They are then directed to download a malicious APK. In some instances, fake bank operators may contact victims via phone or text message, guiding them through the process of enabling installations from unknown sources, a critical step for the malware to be installed outside official app stores.

The malicious APKs are named to closely resemble authentic banking applications, for example, “Intesa Carte.apk,” “Sella Carte.apk,” “Klirway Carte.apk,” “Nexi Carte.apk,” and “CaixaBank.apk.” Upon installation, these applications display a seemingly standard card-verification interface within a WebView screen, complete with a progress indicator and a PIN entry prompt, further deceiving the user.

Once a victim places their card near the phone, the malware activates Android’s NFC reader to extract payment card data using standard EMV protocol commands. This collected data is then transmitted via a WebSocket connection to the attacker’s command-and-control (C2) server. The PIN is subsequently sent through the same channel in a separate message.

The phishing sequence often initiates from domains such as areaclienti-intesa[.]com, which is designed to closely imitate Intesa Sanpaolo’s legitimate online banking platform. After harvesting credentials, the site redirects users through a shortened URL, ultimately leading to the download of the malicious APK from a GitHub repository. This repository, deceptively named “app-scuola” (“school app”), contained 57 commits and 56 unique APK payloads as of early June 2026, indicating active and frequent updates by the attackers.

GitHub-Hosted Payloads and Anti-Analysis Tactics

A significant evolution in this campaign is the attackers’ use of GitHub as a robust platform for payload delivery. The repository is disguised with a fake README file purporting to describe a homework application. A shell script is used to push updated APK builds, accompanied by the commit message “Aggiornato tutto” (Italian for “Updated everything”), further obscuring the malicious intent.

Newer APKs also incorporate a tactic designed to hinder automated security analysis. These files contain intentionally malformed ZIP paths, which cause many standard analysis tools to fail during extraction. This allows the malicious files to bypass automated detection pipelines, potentially resulting in lower match scores or being entirely overlooked, thereby extending the malware’s operational lifespan.

For cybersecurity defenders, critical detection opportunities lie in specific internal NFCShare code markers, the unique combination of WebView and NFC exploitation behavior, and the distinct malformed APK structure present in newer builds. Analysts are advised to utilize tools capable of processing non-standard ZIP archives, such as the open-source apkInspector. This tool can effectively recover family markers and identify the malware even when conventional extractors fail.

What You Should Do

• Be wary of unsolicited links: Never click on links in emails or text messages that claim your banking app needs an update. Always navigate directly to your bank’s official website or use their official app store.
• Download apps from official sources: Only download banking applications and updates from Google Play Store or your bank’s official website. Avoid downloading APKs from third-party websites or direct links.
• Verify app permissions: Before installing any app, carefully review the permissions it requests. Be suspicious of banking apps asking for unusual or excessive permissions.
• Enable two-factor authentication (2FA): Implement 2FA on all your banking and sensitive accounts to add an extra layer of security.
• Monitor bank statements: Regularly check your bank and credit card statements for any unauthorized transactions. Report suspicious activity immediately.
• Keep your OS updated: Ensure your Android operating system and all installed applications are kept up-to-date to benefit from the latest security patches.
• Use robust mobile security software: Install a reputable mobile antivirus or security solution that can detect and prevent malware infections.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.