zLabs’ monitoring uncovered multiple operational patterns where some apps act as scanner/tapper tools paired with POS endpoints, others quietly collect EMV fields and device identifiers and forward them to attackers via Telegram. Operators commonly prompt users to set the malicious app as the default NFC payment method while background services handle NFC events and relay crafted APDU responses to complete fraudulent payments.
Key findings
760+ malicious apps observed since April 2024.
70+ C2 servers and numerous distribution channels identified.
Dozens of Telegram bots/private channels used for exfiltration and coordination.
20 institutions impersonated, including central banks, major retail banks and payment processors across multiple countries.
Malware families reuse the same codebase while repackaging under different brand names and regional lures.
Attackers exploit Android HCE to impersonate legitimate payment apps and relay payment terminal requests to remote servers that return crafted APDU responses. Commands exchanged between apps and C2 include login/register, apdu_command/apdu_response, card_info and telegram_notification, enabling real-time fraud with minimal user interaction.
“Attackers are turning tap-to-pay into a global fraud platform by weaponizing NFC and HCE,” said Nico Chiaraviglio, Chief Scientist at Zimperium. “This is no longer a niche experiment; it’s a scalable attack chain that targets the payment ecosystem at the device level. On-device detection and runtime protection are essential to stop these campaigns on the mobile device where they operate.”
