{"id":238599,"date":"2026-06-09T02:37:19","date_gmt":"2026-06-09T07:37:19","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/06\/nfcshare-android-malware-spreads-via-fake-banking-app-updates-on-github"},"modified":"2026-06-09T02:37:19","modified_gmt":"2026-06-09T07:37:19","slug":"nfcshare-android-malware-spreads-via-fake-banking-app-updates-on-github","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/06\/nfcshare-android-malware-spreads-via-fake-banking-app-updates-on-github","title":{"rendered":"NFCShare Android malware spreads via fake banking app updates on GitHub"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/nfcshare-android-malware-spreads-via-fake-banking-app-updates-on-github.jpg\"><\/a><\/p>\n<p>New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on GitHub.<\/p>\n<p>The malware has evolved and is now targeting customers of multiple banks and financial institutions across Europe in a phishing campaign aimed at stealing payment card data.<\/p>\n<p>After tricking victims with a fake verification screen to place the cards near the mobile device\u2019s near-field communication (NFC) chip, NFCShare reads the information using Android\u2019s IsoDep interface and EMV commands.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on GitHub. The malware has evolved and is now targeting customers of multiple banks and financial institutions across Europe in a phishing campaign aimed at stealing payment card data. After tricking victims with a fake verification screen [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,45,6],"tags":[],"class_list":["post-238599","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-finance","category-robotics-ai"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/238599","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=238599"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/238599\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=238599"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=238599"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=238599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}