NFC Malware Attacks Surge 188%, Warns Kaspersky

Global cybersecurity company Kaspersky has warned of a sharp rise in financial fraud and theft involving Near Field Communication (NFC) technology on smartphones.

According to the company's latest research, 35,600 NFC-based malware attacks targeting Android devices were blocked between January and April 2026. During the same period in 2025, the number stood at 12,300, marking a 188 percent year-on-year increase.

Kaspersky said cybercriminals are exploiting NFC technology, which enables fast data exchange between smartphones and bank cards, to conduct increasingly sophisticated fraud schemes. The attacks are being carried out using malicious tools such as SuperCard X, PhantomCard, Ngate, and modified versions of NFCGate.

Russia has been the most heavily affected country, although the attacks are rapidly spreading across Europe and Latin America.

Two Growing Attack Methods

Researchers identified two primary attack techniques.

The first, known as Direct NFC, tricks users into installing malicious applications under various pretexts. Victims are then instructed to tap their bank cards against their smartphones, allowing sensitive card information to be captured by attackers.

The second and more dangerous method is Reverse NFC. In this scenario, compromised smartphones are used to facilitate transactions through ATMs or payment terminals, causing victims to unknowingly transfer money directly to fraudsters.

Sergey Golovanov, Chief Security Expert at Kaspersky, said attackers previously relied mainly on Direct NFC techniques but are now increasingly adopting Reverse NFC attacks.

"Reverse NFC is more dangerous because victims themselves initiate the transfer of funds. As a result, fraudulent transactions become much harder to distinguish from legitimate ones," he said.

Golovanov also warned that such malware is likely to become more sophisticated and spread to additional countries in the future.

Malware-as-a-Service Expanding the Threat

According to Dmitry Kalinin, the first widely reported NFC-based attacks emerged in late 2023. Initially detected in Europe, similar malware later spread to Russia and other regions.

He noted that cybercriminals are now distributing these tools through a "malware-as-a-service" model, enabling a wider range of threat actors to launch attacks and accelerating the spread of NFC-related cybercrime.

Safety Recommendations

To reduce risks, Kaspersky advises users to:

• Download apps only from official app stores.
• Avoid installing applications from unknown or untrusted sources.
• Ignore instructions from strangers when using ATMs.
• Use reputable mobile security software on smartphones and tablets.

The company stressed that greater user awareness and cautious app installation practices remain the most effective defenses against emerging NFC-based threats.

//DBTech/RI/MI/OR//