NFCShare Android Malware Spreads via Weaponized Banking Apps

A renewed and operationally refined wave of the NFCShare Android banking trojan that delivers NFC card-data theft by masquerading as legitimate banking applications.

First documented in January 2026, NFCShare continues to rely on a social‑engineering phishing flow that coerces victims into sideloading malicious APKs; since 14 May 2026 the campaign has pivoted to Italian and broader European banking brands with increased frequency of rebuilds and packaging measures designed to frustrate automated analysis.

The attacker journey begins with a convincing bank-themed phishing site recently observed as areaclienti-intesa[.]com mimicking Intesa Sanpaolo that requests home‑banking credentials and then instructs the victim to “update” their banking app.

Victims are redirected through shortened URLs (for example, https://tinyurl[.]com/Intesa-Carte) to APKs hosted in a GitHub repo named app-scuola.

The repository acts as a lightweight distribution hub: a short README and a small shell script support frequent commits and automated pushes.

D3 Lab said in a report shared with GBhackers, analyzed NFCShare, an Android banking trojan distributed as a malicious APK through a phishing flow impersonating Deutsche Bank.

Analysis of the Git history reveals dozens of distinct APK blobs and rapid brand rotation across lure names such as Intesa Carte.apk, Sella Carte.apk, CaixaBank.apk and Nexi Carte.apk.

NFCShare Android Malware

Technically, the recent samples retain NFCShare’s core capabilities: a WebView-based local HTML UI that instructs victims to place a payment card near the phone, native NFC reader code using android.nfc.tech.IsoDep to issue EMV APDUs (including a PPSE select), EMV parsing to extract cardPAN, expiry and label, and a mechanism to capture a 4‑digit PIN entered into the WebView.

Extracted data are assembled into a simple ampersand-separated string and exfiltrated to a WebSocket C2. The family markers remain intact package namespace nfc.share.itnamteis, CardInfoitmanteis model, and MQTT-like channel enums (CARD_INFO_CHANNEL, SEND_CHANNEL) facilitating attribution and hunting.

The operational evolution is subtle but meaningful. Newer builds show a higher DEX count (10 versus 8), a changed C2 (for example ws://nfck[.]loseyourip[.]com:8001/), and aggressive packaging tactics: malformed ZIP paths that include entries rooted under /AndroidManifest.xml/ and /classes.dex/.

Because APKs are ZIP archives, naive extractors that attempt to write absolute or malformed paths encounter write errors on analysis hosts and automated pipelines often fail.

These “poisoned” paths do not prevent manual analysis tools such as JADX and apkInspector can still recover code but they increase friction and lower detection or family matching scores in brittle systems.

The UI flow remains a focal point for social engineering. Local HTML templates prompt users, sometimes in Portuguese or other localized strings, to bring their card close and enter a PIN “for security.”

This combination of NFC-derived card data and a captured PIN provides attackers with information sufficient for fraud and card cloning scenarios.

The campaign may also include follow-up social engineering such as SMS or phone calls from faux bank operators to guide victims through enabling installations from unknown sources.

Detection and mitigation guidance is straightforward: do not sideload unknown APKs; verify bank app updates through official app stores; banks should warn customers about unsolicited “update” prompts and shortened URLs; analysts should treat extraction failures as indicators instead of benign errors and use resilient tools like apkInspector to recover artifacts.

IOCs

Filename	MD5	SHA-256
IntesaCarte.apk	ceeb164e387e2a6952dc023eb1cf416a	f1f78e1ad582c9540205ba808836dcb967b7093190bf994632854269692aa2d2
NexiCarte.apk	63d6aaabe27edd5e60339da122d7d0cd	6d29e6e5372cd0690e0df62eb6d98938e91191b0e639fed2476497baa8255405
KlirwayCarte.apk	e937ba13a70cf62da5c5a471df866f6b	7fb836c08ff527443b06d1c20afb6a4b0f51eb373013f211e0d3200bf26527b7
NexiTarjetas.apk	9ee21d157063fd9023a501ec7f551a56	cb147e7ce69723523f604da875d78ca4738e5f416d2297910ee179a5067e79fe
BCCRomaCarte.apk	5ecd01356a39ecf540883ff8171b3677	091870b3f90c9a98000e0d14a67be2db5891ce98a0b1e24b721e3d96241620a5
SellaNFC.apk	fcfd090aa00fe9388da6d20cd2326058	3c81526bcb801d7dcfaea7f379528471d745a36e3c1bdc41877b4bed34b5dce6
FideuramCarte1.apk	dea4c7344a8ab14de16a1018a6e5ccfd	9e95912f1a5fdba5050723f095b7031770b7e2f9627fb60544b41adcbb5b3306
BancaSellaCarte.apk	45ee3983a7c1133f267af09173668864	090a30252991830596c75a945885ca3100d7a40edf4a16d78abd5bbfd90ba268
MooneyCarte.apk	ded72aeca28a3a63ca1fcb8517356896	20b5551b2158f599517f29316884b00e0af6ae3a3bd782909f4b36fca1595698
IntesaCarte1.apk	156ac1f4f722b7a7135817b07b6367ac	d29295f1504676003fd3ccbd3e41a53aabbe80d2025bfb3a6ef9a9fcff97b6cd
IntesaCarte2.apk	cfd294f31384685270ca8838aac22de9	21c91c4cb01c7fd286dc8fa6122f6c43a5227677ffbe3566aa37204cd9e494fe
IntesaCarte.apk	4f71dc13d349971d76970bde1c6e3be5	752f3cacdad6753d4c02bb8e40ef3e0990b55466c18a7b80ec6fa7b9706e40ab
IntesaCarte1.apk	dea7c27a5b42df8eeb86188345ab620c	ce462b41ab7480dce4f290a9921fca51ba40e502d480a348d50770607e3d02b9
IntesaCarte3.apk	f44469676097f336dbd587d895da7a61	9628acabe739b5419f08c5a5c3cd776268bf4a3c25c978341e403bde442e0ece
KlirwayCarte.apk	9dec1a25c9e21e0202216e862e0c9e8b	000218ce36bc7e3b29318e70eb528cad547a837dca2fb955ae63e505825268de
IntesaCarte7.apk	5b68cfe9515654c0d10c228de3abd5c2	d80ea77e9f0dbf75be823b631d3f5572ce484abf4542413482f03094a1c8aad0
provakk.apk	c849829a852666680cd0de0c0ad1c300	f73ad6fad9cfa13deec3e729c99fb2aae33541a84c0e8f53846f9260a2f09252
INTESACARTE5.apk	63ca247be35c8ef19308a36a5660b016	bfca31aafc6fe22f8fc4fa188a88570a70783877342a02362fd0867ba8f547bc
Klirwaycarte1.apk	952d1908bfeb13b8b906c833fea1dea2	b1bdd9549dffcff4fbad6d1c80d7ba513b0ed624e4c74a6df09756edc3882134
CaixaBank.apk	d9e524c5a75ad511b802f35488f6af5d	9fa08e172f73daa3ec8c2fb607b8500bdf915dbf09fcde5a46381e042266149e
IntesaCarte8.apk	dcf340486b832f9092df105a865a186a	2a24223718cb12a8bd81679b307af73a6e062e6f1b26750546a576e285a379e7
provayr.apk	a52d062e9d0115ce35c13de234e3e5d0	15f9d02fbb0124cdf283f7ed3e7f108ff10fe44f9bd8374f48b40a2ebb50168b
kakayarr.apk	10604243405e9480170dd68dab93b3e8	4218216156a2f083c2e79e754d92904403e8e6f54fb91034b193458bbd48346a
IntesaCarte4.apk	54b72c48e263a901674a5bcb15f4cbe3	0cacde8ec59f47dc1bea893f713e922e04aa24c63e8ab0c123aeb0204b0283bb
IntesaCarte10.apk	a6cc136bdda4a9ec69af6ed2ba969a85	73ec7502a638b4520fd8e7d204049f7d064938f58e11d2f27fbb74e61c788257
IntesaCarte6.apk	1a9936e788589c10643556c3b515c42a	69b6c30e329273585cc1c7a11c411040f34094664c68e49b5542561367ce2368
negroeungilipollas.apk	d891da945d285b547642ec5e56ea8dd3	426ab891baf22d4a97f8c22a824f2271e8f11c3ac7532a4893e4b7f48767030f
provaok.apk	41ac1272a5b5971d9a52d55e2a4dd63d	86e9b74bb96db32c03f91f638521be550d5fec827fac6aed70795f576ed8dc45
IntesaCarte9.apk	4050e40d3e4604f85ecab2389cae1827	46e70cb7e3825ae9ea24187c7672e75e70d56bad55c3d143d10903242d59531b
SellaCarte.apk	19e201749611c757b4605635e8521bba	0024620136cf4239544da4768edf7ec7a398e3b610a471033511305ccf670c42
CaixaReactivaTarjeta.apk	8300753f9500ab04ad5bb9920f2d2053	51f7b3f6991bc6253d33e6b93f4e0429957f3d54d967c461dbb82ea2a4694e12
CaixaBankNfc.apk	b16928f4e8447778388e785f746434b3	b0e288e8ac116bc1db13536dee2060f7ebdebc4524cba9147132ed633e028cee

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.