Tap-and-Steal: Over 760 Android Apps Exploit NFC/HCE for Payment Card Theft in Global Financial Scam

Researchers from Zimperium zLabs have revealed a rapid rise in Android apps abusing NFC and Host Card Emulation to steal payment card data and enable fraudulent “tap-to-pay” transactions, with over 760 malicious apps now observed in the wild.

The campaign has expanded beyond initial regions such as Russia to victims in Poland, the Czech Republic, Slovakia and Brazil, and includes more than 70 command-and-control servers alongside dozens of Telegram bots and private channels used to exfiltrate data and coordinate operations.

Impersonations target about 20 institutions, including the Central Bank of Russia, VTB Bank, PSB and Tinkoff Bank in Russia, plus banks in Poland, the Czech Republic, Slovakia and Brazil, and even spoofed services such as Google Pay and ING Bank to boost credibility. The apps prompt users to set the malware as the default NFC payment handler, then silently intercept EMV data fields by relaying signals between the victim’s card and a fraudulent POS terminal.

Dozens of Telegram bots and private channels are used for exfiltration and operator coordination, with victims referred to as “Mamonts” in Russian cybercriminal circles. 3 November 2025. according to Zimperium