b2b-daily
Home | IT | Cyber Security

Hackers Exploit NFC in New Android Payment Fraud Scheme

Avatar photo
by Bairon McAdams
April 23, 2025
Image Credit: Freepik / Freepik
Hackers Exploit NFC in New Android Payment Fraud Scheme
Article Highlights
Off On

Hackers are exploiting near-field communication (NFC) technology to commit instant payment fraud through the Chinese-speaking Android malware-as-a-service platform, SuperCard X. This malware enables real-time theft by using NFC to capture payment card data and make fraudulent transactions at point of sale (PoS) terminals and ATMs.

Unlike older methods such as overlay attacks or SMS interception, SuperCard X uses contactless functionalities in modern payment cards. Infected Android devices become NFC relay stations, simplifying the fraud process. Users of SuperCard X access “Reader” and “Tapper” applications via Telegram channels, making NFC relay fraud easily accessible without complex tool development.

The attack starts with spoofed messages from banks urging victims to call a number. Scammers then pose as bank agents, instructing victims to install the SuperCard X Reader app disguised as security software. This app requires minimal NFC permissions and standard system permissions, avoiding detection by security software.

When victims tap their card against the infected device, the Reader app captures NFC-transmitted card data. This data, including Answer To Reset (ATR) messages, is sent in real-time to the attackers. The Tapper app on another device uses the relayed ATRs to emulate the victim’s card, allowing for transactions at contactless PoS terminals and ATMs. Fraudulent withdrawals increase after convincing victims to lift spending limits. SuperCard X is distinct from other Android banking Trojans, focusing on NFC relay with minimal permissions, evading most antivirus engines. An analysis by Cleafy found extensive code reuse from open-source projects, indicating quick development and easy onboarding for affiliates.

In an Italian campaign, Cleafy noted customizations like tailored APK repackaging and pre-generated login credentials, streamlining the attack. SuperCard X highlights advanced social engineering and strategic minimalism in permissions, challenging current cybersecurity defenses with its covert and effective methods.

Android

Explore more

AI and Generative AI Transform Global Corporate Banking
March 20, 2026

The high-stakes world of global corporate finance has finally severed its ties to the sluggish, paper-heavy traditions of the past, replacing the clatter of manual data entry with the silent, lightning-fast processing of neural networks. While the industry once viewed artificial intelligence as a speculative luxury confined to the periphery of experimental “innovation labs,” it has now matured into the

Is Auditability the New Standard for Agentic AI in Finance?
March 20, 2026

The days when a financial analyst could be mesmerized by a chatbot simply generating a coherent market summary have vanished, replaced by a rigorous demand for structural transparency. As financial institutions pivot from experimental generative models to autonomous agents capable of managing liquidity and executing trades, the “wow factor” has been eclipsed by the cold reality of production-grade requirements. In

How to Bridge the Execution Gap in Customer Experience
March 20, 2026

The modern enterprise often functions like a sophisticated supercomputer that possesses every piece of relevant information about a customer yet remains fundamentally incapable of addressing a simple inquiry without requiring the individual to repeat their identity multiple times across different departments. This jarring reality highlights a systemic failure known as the execution gap—a void where multi-million dollar investments in marketing

Trend Analysis: AI Driven DevSecOps Orchestration
March 20, 2026

The velocity of software production has reached a point where human intervention is no longer the primary driver of development, but rather the most significant bottleneck in the security lifecycle. As generative tools produce massive volumes of functional code in seconds, the traditional manual review process has effectively crumbled under the weight of machine-generated output. This shift has created a

Navigating Kubernetes Complexity With FinOps and DevOps Culture
March 20, 2026

The rapid transition from static virtual machine environments to the fluid, containerized architecture of Kubernetes has effectively rewritten the rules of modern infrastructure management. While this shift has empowered engineering teams to deploy at an unprecedented velocity, it has simultaneously introduced a layer of financial complexity that traditional billing models are ill-equipped to handle. As organizations navigate the current landscape,