Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new Android Trojan called PhantomCard is targeting banking customers in Brazil, with potential for global expansion. The malware relays NFC data from victims' banking cards to fraudsters' devices, enabling unauthorized transactions. Distributed through fake 'Google Play' pages as a 'card protection' app, PhantomCard is based on a Chinese-originating NFC relay Malware-as-a-Service. The actor behind it is a known reseller of Android threats in Brazil. PhantomCard's emergence highlights the growing popularity of NFC-based attacks among cybercriminals and the evolving threat landscape, where local threats can reach global markets through reselling schemes.

PhantomCard is a newly identified Android Trojan malware primarily targeting banking customers in Brazil, with indications of potential global expansion. This malware leverages Near Field Communication (NFC) technology to intercept and relay sensitive data from victims' banking cards to attackers' devices, enabling unauthorized financial transactions. PhantomCard is distributed through deceptive fake 'Google Play' store pages, masquerading as a legitimate 'card protection' application to lure victims into installing it. The malware is based on a Chinese-origin NFC relay Malware-as-a-Service (MaaS) platform, indicating a modular and resellable threat infrastructure. The actor behind PhantomCard is a known reseller of Android threats in Brazil, highlighting a growing trend where localized cybercriminal tools are commercialized and distributed globally. Technically, PhantomCard operates by exploiting the NFC capabilities of infected Android devices to capture card data when victims tap or bring their banking cards close to their phones. This data is then relayed to fraudsters, who can use it to perform unauthorized transactions, bypassing traditional security controls that rely on physical card possession. The malware's presence on Android devices is facilitated by social engineering tactics, including fake app stores and misleading app descriptions. While there are no reported exploits in the wild beyond Brazil yet, the threat's architecture and distribution method suggest a high potential for spread to other regions. The malware's medium severity rating reflects its targeted nature, reliance on user installation, and the significant financial impact it can cause. Indicators of compromise include specific file hashes associated with the malware, which can be used for detection and blocking. PhantomCard exemplifies the evolving threat landscape where NFC-based attacks are becoming more prevalent, and MaaS models enable rapid proliferation of sophisticated malware variants.

Detailed information about PhantomCard: New NFC-driven Android malware emerging in Brazil. Get real-time updates, technical details, and mitigation strategies.

PhantomCard: New NFC-driven Android malware emerging in Brazil - Live Threat Intelligence - Threat Radar | OffSeq.com

PhantomCard: New NFC-driven Android malware emerging in Brazil

A critical vulnerability named DanaBleed was discovered in DanaBot's C2 server, causing memory leaks from June 2022 to early 2025. This bug, introduced in version 2380, exposed sensitive information including threat actor details, server data, and victim credentials. The leak resulted from uninitialized memory in the C2 protocol update. Researchers gained insights into DanaBot's operations, infrastructure, and affiliates. In May 2025, law enforcement dismantled DanaBot's infrastructure and indicted 16 individuals in Operation Endgame. The blog details the technical analysis of the vulnerability, its impact, and the type of data exposed through the memory leak.

DanaBot is a malware-as-a-service platform primarily engaged in cybercrime activities such as banking fraud and information theft. A critical vulnerability, named DanaBleed, was discovered in the Command and Control (C2) server infrastructure of DanaBot. This vulnerability was introduced in version 2380 of the C2 server software and caused a memory leak due to uninitialized memory during a C2 protocol update. The memory leak persisted from June 2022 until early 2025, inadvertently exposing sensitive internal data including threat actor identities, server infrastructure details, and victim credentials. This flaw was a result of poor memory management in the C2 server’s protocol implementation, leading to inadvertent disclosure of critical data. The vulnerability did not require active exploitation in the wild but was an internal bug within the malware’s own infrastructure. Security researchers and law enforcement leveraged this leak to gain unprecedented insight into DanaBot’s operations, infrastructure, and affiliates. This intelligence gathering culminated in Operation Endgame in May 2025, where law enforcement dismantled DanaBot’s infrastructure and indicted 16 individuals. The malware employs a sophisticated and multi-faceted attack framework, utilizing various MITRE ATT&CK techniques such as Windows Management Instrumentation (T1047), External Remote Services (T1133), Application Layer Protocol (T1071), process injection (T1055), credential dumping (T1003), and phishing (T1566), among others. While the vulnerability primarily affected the DanaBot C2 server infrastructure rather than victim endpoints directly, the leaked data included victim credentials, amplifying risks to affected organizations. No direct exploits of this vulnerability were observed in the wild, but the exposure significantly undermined the threat actor’s operational security and exposed their internal mechanisms.

Detailed information about DanaBot C2 Server Memory Leak Bug. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'banking fraud'

Filter Threats

Threats Tagged 'banking fraud'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility