A newly evolved strain of Android malware known as NFCShare is being spread through fake versions of legitimate banking apps, putting mobile users across Europe at serious risk.

The malware is designed to secretly steal payment card data using a phone’s NFC chip, and it has grown into a much broader and more coordinated campaign than when it first appeared.

NFCShare was first spotted in January 2026 when it was caught impersonating Deutsche Bank.

The malware used a fake card-verification screen to trick victims into placing their payment card near their phone, capturing card data over NFC and sending it to an attacker-controlled server.

It also harvested the card PIN before a victim even realized something was wrong. Analysts at d3Lab identified and tracked the malware’s evolution, noting a sharp shift starting around May 14, 2026.

The newer campaign branched out to impersonate multiple Italian and European banking brands, including Intesa Sanpaolo, Banca Sella, Fideuram, Nexi, Mooney, BCC Roma, and Spanish institutions like CaixaBank.

d3Lab said in a report shared with Cyber Security News (CSN) that the core attack method has not changed much, but the operation behind it has grown more polished and evasive.

The actor is now rotating bank brands frequently, rebuilding malicious APKs at a fast pace, and hosting them in a public GitHub repository disguised as a school project. This discipline makes the campaign harder to detect and take down.

Users are lured through phishing websites that look exactly like real banking portals. Once a victim enters their credentials, they are told their banking app needs an update and are directed to download a fake APK.

In some cases, a fake bank operator may call or text the victim to guide them through enabling installs from unknown sources.

The malicious APKs carry names that mirror real banking apps, such as Intesa Carte.apk, Sella Carte.apk, Klirway Carte.apk, Nexi Carte.apk, and CaixaBank.apk, among others.

A victim who downloads one of these files sees what looks like a standard card-verification interface inside a WebView screen, complete with a progress indicator and a PIN entry prompt.

Once the victim places their card near the phone, the malware uses Android’s NFC reader to extract card data using a standard EMV protocol command.

The card number, type, label, and expiry date are packaged and sent over a WebSocket connection to the attacker’s command-and-control server. The PIN is then sent in a second message through the same channel.

The phishing flow begins at a fake website, areaclienti-intesa[.]com, which closely mimics Intesa Sanpaolo’s real portal.

After stealing credentials, the site redirects through a shortened URL, ultimately dropping the malicious APK from a GitHub repository named app-scuola, or “school app.” As of early June 2026, that repository contained 57 commits and 56 unique APK payloads.

GitHub-Hosted Payloads and Anti-Analysis Tactics

One of the more notable shifts in this campaign is how the actor is using GitHub as a payload delivery platform.

The repository is disguised with a fake README describing it as a homework app, and a shell script pushes updated APK builds with the commit message “Aggiornato tutto,” meaning “Updated everything” in Italian.

The newer APKs also introduce a trick designed to slow down automated security analysis. The files contain intentionally malformed ZIP paths, which cause simple analysis tools to fail during extraction.

Automated detection pipelines may produce lower match scores or skip the files, buying the attacker more time in the wild.

For defenders, the strongest detection opportunities lie in the internal NFCShare code markers, the WebView and NFC behavior combination, and the malformed APK structure in newer builds.

Analysts are advised to use tools capable of handling non-standard ZIP structures, such as the open-source apkInspector, which can recover family markers and identify the malware even when standard extractors fail.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.