Android Malware DevilNFC Abuses Kiosk Mode For NFC Relay Fraud

This report describes two Android NFC relay malware families—DevilNFC and NFCMultiPay—that target banking customers in Europe and Latin America. It outlines their delivery via phishing (SMS/WhatsApp), use of fake banking updates and kiosk-mode to trap victims, interception and forwarding of OTPs to a Telegram bot, NFC relay and PIN capture (including Xposed-based host card emulation on rooted attacker devices), plus defanged C2 domains and IPs and evidence of AI-assisted development.