Skip to main content
Mallory
Malware

NFCShare

NFCShare is an Android banking trojan distributed as fake updates or fake versions of legitimate banking apps. It has targeted mobile banking users across Europe, with reporting that it was first observed in January 2026 impersonating Deutsche Bank in Germany and later expanded to impersonate multiple banks and financial institutions, especially in Italy and Spain, including Intesa Sanpaolo, Banca Sella, Fideuram, Nexi, Mooney, BCC Roma, and CaixaBank. Victims are lured to phishing sites that mimic real banking portals, asked to enter banking credentials, and then prompted to download a malicious APK, in some cases from a public GitHub repository disguised as a school project. Some reporting also notes social engineering via fake bank operators calling or texting victims to help them enable installation from unknown sources.

The malware’s core capability is theft of payment card data via the phone’s NFC interface. It presents a fake card-verification flow in a WebView, prompts the victim to place a payment card near the device, reads card data using Android NFC functionality and EMV/IsoDep commands, and captures the victim’s PIN entered into the app. Reported stolen fields include card number, card type, card label, and expiry date. The malware exfiltrates the card data and PIN to attacker-controlled infrastructure over WebSocket. The stolen information has been assessed as usable for NFC payment relay fraud.

Operationally, the campaign has been described as rapidly rotating impersonated banking brands and rebuilding APKs frequently. Malicious APKs were hosted in the GitHub repository github[.]com/antoniocastaldo1998/app-scuola, which reportedly contained dozens of unique APK payloads and used a fake README describing the project as homework software. Observed APK names included Intesa Carte.apk, Sella Carte.apk, Klirway Carte.apk, Nexi Carte.apk, Fideuram Carte.apk, Mooney Carte.apk, CaixaBank.apk, CaixaBankNfc.apk, and CaixaReactivaTarjeta.apk. Newer samples reportedly introduced malformed ZIP paths inside APKs to hinder automated extraction and reduce detection by some analysis pipelines.

High-confidence family markers and infrastructure mentioned in the reporting include package name com.modol.nap, namespace nfc.share.itnamteis, phishing domain areaclienti-intesa[.]com, shortened lure URL tinyurl[.]com/Intesa-Carte, and WebSocket C2 endpoints ws://38[.]47[.]213[.]197:7068/ and ws://nfck[.]loseyourip[.]com:8001/. D3Lab is the primary researcher cited as tracking the malware’s discovery and evolution. Reporting notes similarities in abuse pattern to other NFC-focused Android threats such as NGate, SuperCard X, and RelayNFC, while also stating NFCShare has distinct code, libraries, architecture, and implementation details.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566PhishingEvidence3

Users are lured through phishing websites that look exactly like real banking portals. Once a victim enters their credentials, they are told their banking app needs an update and are directed to download a fake APK.

T1566.003Spearphishing via ServiceEvidence1

Victims are then urged to update their banking app and are redirected to a GitHub repository hosting a malicious APK file.

Execution

2 techniques
T1059.004Unix ShellEvidence1

The repository is disguised with a fake README describing it as a homework app, and a shell script pushes updated APK builds with the commit message “Aggiornato tutto,” meaning “Updated everything” in Italian.

T1204.002Malicious FileEvidence1

After stealing credentials, the site redirects through a shortened URL, ultimately dropping the malicious APK from a GitHub repository named app-scuola... In some cases, a fake bank operator may call or text the victim to guide them through enabling installs from unknown sources.

Stealth

2 techniques
T1027Obfuscated Files or InformationEvidence2

The newer APKs also introduce a trick designed to slow down automated security analysis. The files contain intentionally malformed ZIP paths, which cause simple analysis tools to fail during extraction.

T1036MasqueradingEvidence2

NFCShare was first spotted in January 2026 when it was caught impersonating Deutsche Bank... The newer campaign branched out to impersonate multiple Italian and European banking brands.

Credential Access

2 techniques
T1056Input CaptureEvidence1

The malware steals the card number, type, expiry date, and a 4-digit PIN entered by the victim under the pretense of a security step

T1649Steal or Forge Authentication CertificatesEvidence1

Recent NFCShare attacks observed starting May 14 begin with the victim visiting a phishing site that impersonates a real bank and asks for banking credentials.

Collection

2 techniques
T1005Data from Local SystemEvidence2

Once the victim places their card near the phone, the malware uses Android’s NFC reader to extract card data using a standard EMV protocol command.

T1056Input CaptureEvidence1

The malware steals the card number, type, expiry date, and a 4-digit PIN entered by the victim under the pretense of a security step

Command and Control

1 technique
T1071Application Layer ProtocolEvidence2

The card number, type, label, and expiry date are packaged and sent over a WebSocket connection to the attacker’s command-and-control server. The PIN is then sent in a second message through the same channel.

Exfiltration

1 technique
T1567Exfiltration Over Web ServiceEvidence1

The malware steals the card number, type, expiry date, and a 4-digit PIN entered by the victim under the pretense of a security step, and exfiltrates it to the attacker’s command-and-control (C2) host over a WebSocket channel.

INDICATORS OF COMPROMISE

IOCs tracked for this family

32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
25 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app4 days ago
domain●●●●●●●●●●●●View more in app4 days ago
domain●●●●●●●●●●●●View more in app4 days ago
hash.md5●●●●●●●●●●●●View more in app4 days ago
hash.md5●●●●●●●●●●●●View more in app4 days ago
hash.md5●●●●●●●●●●●●View more in app4 days ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching32

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.