🤚 The Open-Palm Tap

A new Android trojan called NFCShare would like you to hold your credit card against your phone for “security verification.” It will then read your card number, expiry date, card type, and PIN using your phone’s own NFC chip, send everything to an attacker’s command-and-control server over a WebSocket channel, and thank you for your cooperation. The malware is spreading through fake banking app updates hosted on GitHub, because apparently even threat actors have embraced open-source hosting.

Researchers at D3Lab, led by analyst Andrea Draghetti, have been tracking NFCShare since January 2026. The campaign primarily targets customers of Italian and Spanish banks — including Intesa Carte, Sella Carte, Banca Sella, Nexi Carte, Fideuram Carte, Mooney Carte, and CaixaBank — with earlier variants taking a swipe at Deutsche Bank in Germany. Since the GitHub repository was created on April 10, the attackers have uploaded 56 unique malicious APKs, each impersonating a different banking application.

The technical mechanism is almost elegant in its audacity: NFCShare uses Android’s IsoDep interface and EMV commands — the same protocol your legitimate banking app uses — to read card data when a victim taps their physical card to their phone’s NFC sensor. It’s not a vulnerability in NFC. It’s a vulnerability in the person holding the phone.

👐 The Two-Handed Withdrawal

The attack chain is a masterclass in social engineering that would make a timeshare salesperson weep with admiration:

1. Phishing sites impersonating real banks tell victims their banking app needs an urgent update
2. The “update” link redirects to a GitHub repository hosting the malicious APK
3. For the less internet-literate, the attackers also deploy SMS messages and phone calls from fake bank representatives
4. Once installed, the app presents a convincing interface asking the victim to “verify their card” by tapping it to the phone
5. The victim enters their 4-digit PIN as part of the “verification process”
6. All data — card number, expiry, type, and PIN — is exfiltrated over a WebSocket connection to the C2 server

Notice the genius of step four. The app doesn’t hack anything. It doesn’t exploit a zero-day. It doesn’t even need root access. It simply asks you to do something you do every day — tap your card — in a context that feels legitimate. The malware’s greatest technical achievement is a convincing user interface.

And then there’s the GitHub angle. The attackers are hosting their malware on the world’s largest code repository, which gives the download URL a veneer of legitimacy that “download-totally-real-bank-update.sketchy.xyz” simply cannot match. When your phishing URL starts with “github.com,” even security-conscious users pause before hitting the back button.

🌿 The Gentle Awakening

There’s something philosophically unsettling about a malware that weaponizes the technology designed to make payments more secure. NFC was supposed to be the answer to magstripe skimming. Tap-to-pay was marketed as the safe, modern alternative to swiping your card through a reader that may or may not have been tampered with by someone in a hoodie.

And now here we are, in the year 2026, watching threat actors use the same contactless protocol to read your card data through your own phone. The security feature became the attack surface. The contactless revolution just made contact with reality.

The broader lesson is one that the cybersecurity industry keeps learning and the general public keeps ignoring: no technology is more secure than the human operating it. You can encrypt the channel, authenticate the endpoint, and harden the protocol. But if someone calls a victim, says “I’m from your bank,” and the victim installs an app and taps their card — the cryptography was never the weak link. The weak link was the mammal.

👑 The Gold-Leaf Balance Statement

NFCShare represents an evolution in mobile banking trojans that should concern every financial institution offering a mobile app. Unlike traditional Android banking malware that overlays fake login screens to steal credentials, NFCShare steals the physical card data itself. This means the attacker doesn’t just get access to your app — they get a full clone of your card. They can manufacture a physical duplicate or use the data for card-not-present transactions worldwide.

The GitHub distribution vector is equally alarming. Financial institutions have spent years training customers to look for “https” and legitimate-looking domains. GitHub.com is both. The platform’s trust reputation — built on two decades of hosting open-source code that doesn’t steal your money — is being weaponized as social proof.

Key takeaways for the security-conscious:

• Banks will never ask you to update your app via a link — updates come from the Google Play Store
• No legitimate app needs you to tap your card for “verification” — your bank already knows your card details
• GitHub hosting does not mean legitimate software — anyone can upload anything
• If someone calls claiming to be your bank and asks you to install something, hang up — then call your bank using the number on the back of the card you were about to compromise

With 56 unique APKs deployed across multiple European banks in just two months, NFCShare is scaling like a startup with good product-market fit. The product is card theft. The market is everyone with a phone and a credit card. The fit is distressingly snug.

“The app asked me to tap my card for security, so I tapped my card for security. In retrospect, the app’s idea of security and my idea of security were two very different business models.” — The Slap of Wisdom Contactless Payments Desk, currently paying for everything in cash and feeling very analog about it