payment data Archives

AppWizard

November 4, 2025

Hackers Hit Android Users, Drain Bank Accounts Remotely Through 760 Apps: Report

Cybersecurity experts have identified over 760 malicious applications that exploit Near Field Communication (NFC) technology to target Android devices, compromising sensitive user data and financial information. These apps often disguise themselves as legitimate banking and government services, convincing users to set them as default NFC payment methods. Once installed, they can intercept critical information such as login credentials and card details, which is then transmitted to hackers via Telegram channels. The campaign, which began in April 2024, affects users in countries including Russia, Poland, the Czech Republic, Slovakia, and Brazil, impersonating banks like Santander and VTB. Stolen data is sent to over 70 command-and-control servers managed by automated Telegram bots.

AppWizard

November 3, 2025

Android Apps misusing NFC and HCE to steal payment data on the rise

Researchers from Zimperium zLabs have identified over 760 Android applications exploiting Near-Field Communication (NFC) and Host Card Emulation (HCE) technologies to illegally acquire payment data. Since April 2024, there has been a significant increase in NFC relay fraud, affecting banks, payment services, and government portals globally, including Russian banks and various European financial institutions. The malware operates as paired “scanner/tapper” toolchains or standalone data collectors, exfiltrating sensitive EMV data and transmitting it to Telegram channels. Operators control these applications via command-and-control (C2) servers, allowing for fraudulent transactions with minimal user involvement. More than 70 C2 servers and numerous Telegram bots have targeted over 20 institutions worldwide, primarily focusing on Russian banks. The rise of “Tap-to-Pay” transactions has made NFC a target for cybercriminals, with harmful applications exploiting Android’s NFC permissions to steal payment data. Zimperium has provided Indicators of Compromise (IOCs) related to this campaign for safeguarding systems.