Zero-Detection RelayNFC Android Malware Turns Phones Into Remote Card Readers

Cyble Research and Intelligence Labs (CRIL) has identified a new NFC relay malware named RelayNFC, targeting mobile payment users in Brazil. This malware turns Android devices into remote card readers, allowing attackers to conduct fraudulent transactions. RelayNFC is lightweight and evasive, with zero detections on VirusTotal, indicating a significant security threat. The malware is distributed through phishing sites that mimic financial security portals, tricking users into downloading it.

Built using React Native, RelayNFC complicates reverse engineering. Once installed, it prompts users to tap their payment cards, capturing card data and PINs, and relaying them to attackers in real-time via a command-and-control server. CRIL also discovered a variant attempting to implement Host Card Emulation (HCE), suggesting ongoing development. This malware represents a serious escalation in financial threats, enabling real-time EMV transaction relays controlled by the victim's device.