DevilNFC: Android-Malware nutzt Kiosk-Modus für NFC-Relay-Angriffe

Unlike previous threats, DevilNFC does not rely on shared infrastructure or borrowed code — it is built entirely from the ground up by a distinct threat actor group. The attack begins with a phishing message via SMS or WhatsApp, directing the victim to a landing page impersonating the Google Play Store.

The page presents the malicious app as a mandatory security update from a legitimate Spanish-language banking institution. Once installed, the malware activates immediately and the victim loses control of their device without realizing it.

Notable NFC Relay Malware Families Observed Over the Past Year (Source – Cleafy) Analysts at Cleafy, whose Threat Intelligence and Response team identified and analyzed the malware, noted that DevilNFC is the more advanced of two newly documented NFC relay families, with the other being NFCMultiPay. Cleafy said in a report shared with