Executive Summary

In June 2026, D3 lab researchers reported on a new banking trojan. NFCShare is an Android banking trojan initially distributed as a malicious Android Package file (APK) through a phishing flow impersonating Deutsche Bank. The malware presents a fake card-verification interface, prompts the victim to place a payment card near the phone, collects the card PIN, and exfiltrates NFC-derived payment-card data to a WebSocket endpoint.

Since 14 May 2026, a newer wave of NFCShare APKs has been observed impersonating Italian and European banking brands, originating from a phishing website (areaclienti-intesa[.]com) mimicking Intesa Sanpaolo. The evolution is in campaign operations and analysis resistance: the actor is rotating brands, rebuilding APKs frequently, using URL shorteners, hosting payloads in a public GitHub repository disguised as a school project, and shipping APKs with malformed ZIP paths that can break automated extractors.

Key Takeaways

- The core NFC and exfiltration logic remains largely unchanged. The relevant evolution is operational and anti-analysis oriented: more frequent APK rebuilds, brand rotation, a new C2 endpoint, a 10-DEX layout, and malformed ZIP paths designed to break naive APK extractors.

- The GitHub repository used for hosting is named “app-scuola” (roughly “school app”), with a decoy README. As of 5 June 2026, the repository contains 57 commits starting 10 April 2026, with the vast majority using the commit message “Aggiornato tutto” (“Updated everything”).

- Victims may also receive an SMS or phone call from a fake bank operator who guides them through the process, including enabling Android installation from unknown sources in order to sideload the APK.

- The most important technical evolution is the packaging: newer APKs contain malformed ZIP entries such as paths rooted under /AndroidManifest.xml/, /classes.dex/, and /resources.arsc/. Simple extraction tools may try to write those entries as absolute paths, causing extraction failures.

- For defenders, the most resilient detection opportunities are not the APK filename or the C2 endpoint, but the internal NFCShare code markers, the WebView/NFC behavior combination, and the malformed APK structure introduced in the newer builds.

Indicators of Compromise (IOCs)

Network IOCs

File Hashes (SHA-256)

Application IOCs

TTPs (MITRE ATT&CK)

The malware retains key internal markers: the nfc.share.itnamteis namespace, CardInfoitmanteis model, MqttChannel enum, and NFC reader code using android[.]nfc[.]tech[.]IsoDep to send an EMV PPSE select APDU and parse returned payment card data.

Mitigation Options

D3 Labs included the following potential mitigations:

For End Users / Banks

- Block sideloading: Enforce policies preventing installation from unknown sources on corporate and BYOD devices.

- User awareness: Train customers to recognize that legitimate banks never request app updates via SMS links or phone calls.

- Warn users that attackers may use a social engineering layer via SMS or fake bank operator phone calls to guide victims through enabling unknown-source APK installation.

For Security Teams / Analysts

- Detection via code markers: Focus detection on internal NFCShare code markers (package name, namespace, MqttChannel enum), the WebView/NFC behavior combination, and malformed APK ZIP structure rather than filename or C2 endpoint alone.

- APK analysis tooling: Use the open-source tool apkInspector for APK parsing and artifact extraction, which is useful for identifying NFCShare family markers and DEX layout differences even in malformed samples.

- GitHub monitoring: Monitor for public repositories hosting bank-themed APK files with suspicious commit patterns.

- Treat failed APK extraction as a potential indicator rather than a benign signal, in this campaign, extraction failures are themselves useful indicators of the newer NFCShare packaging.

For Mobile Security / MDM

- Block NFC reader permissions for sideloaded or unverified applications.

- Implement behavioral detection for apps combining WebView UI with android[.]nfc[.]tech[.]IsoDep usage and WebSocket outbound connections.

- Block known malicious domains at the DNS/proxy layer.