Tap-and-Steal: The Rise of NFC Relay Malware on Mobile Devices

Since April 2024 zLabs identified a large-scale Android NFC/HCE relay malware campaign—over 760 malicious apps—masquerading as banks and payment services across multiple countries to steal EMV card data and enable fraudulent transactions; operators use 70+ C2 servers, Telegram bots/channels for exfiltration, websocket bidirectional control, and register malicious HCE services to intercept payment APDUs, with MITRE ATT&CK mappings and IOCs provided.