NFC Relay Attack: 700+ Android Apps Harvest Banking Login Details

Researchers at zLabs identified over 760 malicious Android applications designed to steal banking credentials and enable fraudulent transactions, a campaign described as a sophisticated NFC-based crime wave that has exploded across multiple continents. What began as isolated incidents in April 2024 has grown into a large-scale operation targeting financial institutions across Russia, Poland, the Czech Republic, Slovakia, Brazil, and beyond, with hundreds of Android samples documented throughout 2024.

The malware ecosystem is supported by more than 70 command-and-control servers, dozens of private Telegram channels for data exfiltration, and apps impersonating around 20 legitimate banking institutions and government services. Malicious apps use Android’s Host Card Emulation to intercept payment data, request to become the default NFC payment method, and render convincing banking interfaces often via WebViews.

Threat actors have impersonated organisations such as VTB Bank, Tinkoff Bank, Santander, PKO Bank Polski, Bradesco, Itaú, and government services like Russia’s Gosuslugi portal, to trick users into granting NFC permissions. The campaigns employ APDU relay-style commands to forward terminal requests to remote servers, enabling fraudulent transactions from victims’ payment credentials.