Massive surge of NFC relay malware steals Europeans’ credit cards

Researchers have observed a rapidly expanding NFC relay malware campaign targeting Android devices—more than 760 malicious apps and over 70 C2 servers—primarily in Eastern Europe, using Android HCE to capture or emulate EMV/APDU exchanges so attackers can authorize POS payments without the physical cardholder present; variants include EMV data exfiltration to Telegram, APDU relay toolkits, real-time "ghost-tap" payment manipulation, and fake payment/banking apps impersonating Google Pay or banks, and users are advised to avoid sideloading APKs, verify official bank app links, check NFC permissions, use Play Protect, and disable NFC if not needed.