RelayNFC

RelayNFC is an Android mobile malware family used to conduct NFC relay attacks against contactless payment cards. Reporting places its deployment in late 2025, with campaigns targeting users in Brazil, including Brazilian banking users, and distribution via phishing sites and decoy Portuguese-language pages. The malicious app masquerades as a payment-card security or verification tool and socially engineers victims into tapping their payment card to the phone and entering the card PIN. RelayNFC then captures contactless payment data and relays EMV/APDU traffic in real time over WebSockets to attacker-controlled infrastructure, enabling fraudulent transactions that mimic physical card presence. Multiple sources describe it as targeting contactless payment cards and siphoning payment data for NFC payment relay fraud. Technical reporting states the malware is built with React Native and Hermes bytecode / a Hermes-compiled payload, which complicates static analysis and contributes to its lightweight, evasive profile; one report also noted zero VirusTotal detections at the time of publication. Additional reporting indicates the operators were experimenting with Host Card Emulation (HCE) for future attacks. RelayNFC has been discussed alongside other NFC-relay malware families such as NGate and SuperCard X as part of a broader trend of mobile malware abusing NFC for financial fraud.