MalwarePublished 30 Jan 2026Updated 1 Mar 2026

NFCShare Android Trojan: NFC card data theft via malicious APK

Source AlienVault OTX General

Description

A new Android trojan, named NFCShare, has been discovered targeting Deutsche Bank customers through a phishing campaign. The malware, disguised as a banking app update, prompts users to perform a fake card verification process. It exploits NFC technology to steal card data and PINs, which are then exfiltrated to a remote WebSocket endpoint. The trojan's distribution, user flow, and technical analysis are detailed, including its NFC reading capabilities and string obfuscation techniques. The malware shows links to Chinese-linked tooling and similarities to other NFC-based threats. IOCs include hashes, package details, and network indicators.

Impact

For European organizations, especially financial institutions and their customers, NFCShare represents a targeted threat that could lead to significant financial fraud and reputational damage. The theft of card data and PINs enables attackers to perform unauthorized transactions, potentially bypassing traditional security controls due to the use of legitimate NFC hardware. Banks may face increased fraud claims, regulatory scrutiny, and customer trust erosion. The malware's focus on Deutsche Bank customers suggests a targeted campaign that could expand to other banks or countries with similar banking app ecosystems. Organizations relying on Android mobile banking apps with NFC features are at risk, particularly if users are not trained to recognize phishing attempts or verify app updates through official channels. The data exfiltration via WebSocket also implies potential for real-time monitoring and rapid misuse of stolen credentials. Additionally, the presence of Chinese-linked tooling may raise geopolitical concerns and complicate attribution and response efforts. Overall, the threat could disrupt banking operations, increase fraud losses, and necessitate costly incident response and remediation efforts.

Defensive guidance

1. Educate users to only install app updates from official app stores and verify update prompts directly through official bank communications. 2. Implement mobile threat defense solutions that detect malicious APKs and suspicious NFC activity on corporate or customer devices. 3. Monitor network traffic for unusual WebSocket connections, especially to known malicious domains like 'portale-deut.com' and suspicious IP addresses. 4. Employ app vetting and integrity checks within banking apps to detect tampering or unauthorized versions. 5. Encourage customers to use multi-factor authentication methods that do not rely solely on card data or PINs. 6. Banks should monitor fraud patterns for NFC-related anomalies and coordinate with law enforcement and cybersecurity communities for threat intelligence sharing. 7. Limit NFC functionality or require explicit user consent for NFC operations within banking apps. 8. Regularly update threat intelligence feeds with the provided IOCs (hashes, IPs, domains) to enable proactive detection. 9. Conduct phishing awareness campaigns tailored to the banking customer base to reduce the risk of initial infection. 10. Collaborate with mobile OS vendors to improve detection and blocking of malicious apps exploiting NFC capabilities.

Indicators of compromise

Domains 1

portale-deut.com

IP addresses 1

38.47.213.197

Hashes 3

8559091709db25c061b856921f55e0eb
faf180d3c26db7b724a6f6c307282417dbed16a6
afbe6751d339fbc5b7bddd29429a11740e82fef935a61acaf2fe5487444dbed4

Community reviews

Loading reviews…