RelayNFC Malware Targets Mobile Payment Users

Cyble Research and Intelligence Labs (CRIL) has identified a new NFC relay malware campaign targeting mobile payment users. The malware, named RelayNFC, turns a victim's Android device into a remote card reader, enabling attackers to perform fraudulent contactless transactions. The malware is distributed through phishing sites and captures card data and PINs, relaying them to an attacker-controlled server. RelayNFC uses a real-time APDU relay channel and has zero detections on VirusTotal, indicating low visibility across security tools.