NFCShare Android malware spreads via fake banking app updates on GitHub
NFCShare is using fake bank app updates on GitHub to steal NFC card data from Android users across Europe, including card numbers, expiry dates, and PINs.
Intelligence analysis by GPT-5.4 Mini
The malware is being pushed through phishing sites that impersonate banks, then steer victims to a GitHub-hosted APK disguised as a banking app update. Once installed, it uses a fake verification flow to harvest payment card data through the phone’s NFC chip and send it to attacker infrastructure.
It is like a fake bank helper telling someone to tap a card on a phone for a “check.” The trick lets thieves copy the card details, like stealing a house key after making a copy.
Analysis
What the campaign does
D3Lab says new NFCShare variants are being distributed as fake updates for legitimate banking apps hosted on GitHub. The campaign begins with a phishing site that imitates a real bank and asks for banking credentials, then redirects the victim to a malicious APK download.
How the malware steals card data
After installation, the malware shows a fake verification screen that tells the victim to place a payment card near the phone’s NFC chip. NFCShare then reads the card through Android’s IsoDep interface and EMV commands. According to the article, it collects the card number, card type, expiry date, and a 4-digit PIN entered by the victim as part of the supposed security step. That data is then sent to the attacker’s command-and-control host over a WebSocket channel.
The stolen information can be used in NFC payment relay schemes, which the article links to prior malware families such as NGate, SuperCard X, and RelayNFC.
What changed in the latest wave
D3Lab first documented NFCShare in January 2026. The newer activity observed from May 14 shows broader targeting than before: the GitHub repository used for distribution has hosted 56 unique APKs impersonating banking apps, mostly for institutions in Italy and Spain. The article notes that the malware initially targeted only Deutsche Bank in Germany, suggesting the campaign has expanded.
One new defensive wrinkle is malformed APK packaging. The newer samples include poisoned file paths inside the ZIP archive, which can confuse some extraction tools and slow static analysis. D3Lab says this does not stop manual analysis or code recovery, but it can interfere with automated tooling.
Defensive takeaway
The article advises Android users to download banking apps only from Google Play, enable Play Protect, and be skeptical of any verification prompt that asks them to scan a card over NFC.
Key points
- D3Lab says NFCShare is now being spread as fake banking app updates hosted on GitHub.
- The malware tricks victims into placing payment cards near the phone’s NFC chip to steal card data.
- Stolen data includes the card number, type, expiry date, and a 4-digit PIN entered by the victim.
- The campaign has shifted from targeting Deutsche Bank alone to impersonating many banks, mostly in Italy and Spain.
- New samples use malformed APK packaging to interfere with some automated analysis tools.
The article points to practical defenses that can reduce exposure, including using Google Play, keeping Play Protect enabled, and avoiding NFC verification prompts from untrusted sources. D3Lab also says the malformed APK trick frustrates some automated analysis, which may help defenders spot and study the campaign faster.
If the campaign keeps expanding, more banking customers across Europe could be tricked into handing over card data through the fake verification flow. The use of phishing sites, GitHub-hosted APKs, and possible SMS or phone-call social engineering gives attackers multiple ways to reach victims.
