DevilNFC Malware Traps Android Users in NFC Relay Attacks

Gbhackers •Mayura Kathir • May 20, 2026

A newly identified Android malware family named DevilNFC is raising concern among cybersecurity researchers for its advanced use of kiosk mode to trap victims during NFC relay attacks. These malware families mark a significant evolution in NFC relay threats. Unlike earlier campaigns dominated by Chinese-speaking Malware-as-a-Service ecosystems, DevilNFC and NFCMultiPay are developed by independent regional […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DevilNFC Malware Exploits NFC Relay Attacks on Android Devices The newly discovered DevilNFC malware targets Android users by employing NFC relay attacks combined with a Kiosk Mode trap. Victims are locked into a fake banking interface, allowing attackers to steal card data. The malware is particularly effective against users in Europe and Latin America, showcasing a high level of technical sophistication. Unlike previous malware campaigns, DevilNFC is developed independently rather than through established Malware-as-a-Service platforms. The emergence of this malware marks a significant evolution in the threat landscape surrounding NFC technology. No specific CVEs have been reported yet, and the full scope of the impact remains under investigation. Cybersecurity experts are urging users to remain vigilant against potential NFC-related threats. 2 sources 67

Extracted Entities

DevilNFC Malware Traps Android Users in NFC Relay Attacks

The full story

Extracted Entities

Attack Types (1)

Malware (2)

Platforms (1)