DevilNFC Malware Traps Android Users in NFC Relay Attacks

A newly identified Android malware family named DevilNFC is raising concern among cybersecurity researchers for its advanced use of kiosk mode to trap victims during NFC relay attacks.

These malware families mark a significant evolution in NFC relay threats. Unlike earlier campaigns dominated by Chinese-speaking Malware-as-a-Service ecosystems, DevilNFC and NFCMultiPay are developed by independent regional threat actors.

Analysis shows DevilNFC is linked to Spanish-speaking operators, while NFCMultiPay carries strong indicators of Brazilian Portuguese origin. This shift highlights how local cybercriminal groups are increasingly building their own tooling rather than relying on external platforms.

DevilNFC stands out due to its sophisticated architecture and attack flow. It uses a single Android application package that serves dual purposes depending on the device.

On a victim’s phone, it acts as an NFC reader, while on a rooted attacker device, it transforms into a card emulator. This is achieved through a hooking framework that intercepts NFC communications at the system level, bypassing standard Android APIs.

Cleafy’s Threat Intelligence said in a report shared with GBhackers, DevilNFC operates alongside another emerging family, NFCMultiPay, both targeting banking customers across Europe and Latin America.

DevilNFC is more sophisticated: a single APK that operates as a passive reader on the victim’s unrooted device and transforms into a system-level card emulator on the attacker’s rooted hardware.

The infection typically იწყs with phishing messages sent عبر SMS or WhatsApp, impersonating legitimate banking alerts. Victims are directed to a fake Google Play page and tricked into installing the malicious app as a security update.

Once launched, the malware immediately activates Android’s kiosk mode, locking the device into a full-screen interface that prevents the user from exiting or accessing other functions.

DevilNFC Malware Traps Android Users

This kiosk mode capability is central to the attack. It disables navigation controls and overrides the back button, effectively trapping the victim inside a fake banking interface.

The compromise begins with a phishing message delivered via SMS or WhatsApp, directing the victim to a landing page impersonating the Google Play Store, presenting the malicious application.

While the victim is unable to exit, the malware initiates the NFC relay process in the background. The user is prompted to tap their payment card and enter their PIN under the guise of verification.

At the same time, DevilNFC silently intercepts incoming SMS messages to capture one-time passwords sent by banks.

These credentials, along with the victim’s PIN and card data, are transmitted in real time to attacker-controlled servers and Telegram channels.

The APDU relay runs on a persistent raw TCP socket and uses Google Protocol Buffers for binary serialization.

A deliberate fake error message is then displayed, instructing the victim to hold their card longer, extending the relay window to ensure transaction completion.

In contrast, NFCMultiPay uses a simpler but still effective approach. It relies entirely on Java without requiring root access or native libraries.

The attack involves two devices and a cloud-based relay server, with victims guided through a spoofed banking interface. Unlike DevilNFC, it does not lock the device but instead depends on continuous social engineering to maintain user interaction.

REST polling is replaced entirely by event-driven MQTT over TCP port 1883, eliminating the polling latency that characterized the first version. 

Despite architectural differences, both malware families share key capabilities. They treat PIN harvesting as a mandatory step, enabling attackers to perform not only contactless payments but also ATM withdrawals and chip-and-PIN transactions globally.

Researchers also observed signs of AI-assisted development in both families. DevilNFC includes highly structured phishing templates with complex logic, while NFCMultiPay features unusual logging formats consistent with outputs generated by large language models.

This suggests that generative AI tools, combined with publicly available code such as NFCGate, are lowering the barrier to entry for cybercriminals.

The emergence of DevilNFC and NFCMultiPay reflects a broader trend in the threat landscape. As open-source tools and AI capabilities become more accessible, attackers no longer need deep technical expertise to develop functional malware.

Instead, they can assemble and customize existing components, accelerating the spread of advanced fraud techniques across new regions.

IOCs

Type	Value	Description
Domain	nfcrackatm[.]com	DevilNFC C2 / Relay Server
Domain	spicynagets[.]shop	DevilNFC C2 / Relay Server
IPV4	185.203.116[.]18	NFCMultiPay C2
IPV4	47.253.167[.]219	NFCMultiPay C2
MD5	caa5e8cf3275339d251210072ebe88c2	DevilNFC Apk Sample
MD5	35dd9c3a56e88a39bf6c8fdad46b0398	NFCMultiPay Apk Sample
MD5	9d19527aeb4cabfb40bbaea6d73b5ff0	NFCMultiPay Apk Sample
Package Name	com.devilnfc.reader	DevilNFC APK Package Name

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.