Android NFC Malware ‘PhantomCard’ Hijacks Contactless Payments, Banks Warn

Cybersecurity researchers have uncovered a sophisticated Android banking Trojan named PhantomCard, capable of hijacking contactless payments.

Disguised as a card protection app, it tricks users into tapping their banking card to their phone, secretly relaying card data to fraudsters who then complete ATM or POS transactions remotely.

How PhantomCard Works

PhantomCard is delivered through fake Google Play pages that host a deceptive app called “Proteção Cartões”. The app uses NFC to read EMV card data and request your PIN without requiring suspicious permissions. It then transfers this sensitive information to a relay server, allowing criminals to use your card as if it were physically present at the point of sale or ATM.

Variants of the malware are sold as Malware as a Service (MaaS), enabling multiple affiliates to carry out tailored NFC relay attacks in regions like Brazil and potentially worldwide.

Echoes of Past NFC Threats and Global Trends

Tech experts compare PhantomCard to earlier NFC threats like NGate and NFCGate, malicious toolkits that paved the way for real-world NFC relay attacks in Europe. The malware’s evolution underscores how contactless payments, once seen as secure, are now a major attack vector.

Another variant, SuperCard X, also blends smishing, fake bank alerts, and NFC relay to clone cards and steal funds via ATM and POS terminals, first spotted in Italy through Telegram-run campaigns.

What You Should Do to Protect Your Wallet From PhantomCard

• Download only from trusted stores, and ignore suspicious links or unsolicited apps.
• Disable NFC when not in use, especially if your device allows it.
• Install mobile security software with malware detection, like zDefend or Google Play Protect.
• Watch for unusual banking alerts, double-check any prompts, and never share your PIN or allow card taps without context.

Fraudsters are now empowering remote NFC relay scams that bypass typical banking safeguards. Since smartphones naturally support contactless communication, this technique gives cybercrime a whole new level of stealth and efficiency.