DevilNFC Android Malware Uses Kiosk Mode to Trap Victims During NFC Relay Attacks

analysts from Cleafy identified DevilNFC, an advanced Android banking malware that uses phishing-distributed apps to activate Android Kiosk Mode and perform NFC relay attacks—emulating cards and reading PINs by injecting a relay module into the NFC daemon—enabling unauthorized ATM and point-of-sale transactions; the report documents technical TTPs, AI-assisted development indicators, geographic targeting in Europe and LATAM, and provides IoCs including domains, IPs, MD5 hashes, and a package name.