Italy – October 19, 2026 -- A newer wave of the NFCShare Android banking trojan, active since 14 May 2026, ships APKs with malformed ZIP paths that can break automated extraction tools, D3 Labs researchers reported.
Campaign shifts from Deutsche Bank lure to Italian and European brands
NFCShare first spread as a malicious APK through a phishing flow impersonating Deutsche Bank. The newer wave impersonates Italian and European banking brands and originates from a phishing site mimicking Intesa Sanpaolo. The malware shows a fake card-verification screen, asks victims to hold a payment card near the phone, collects the card PIN and sends NFC-derived card data to a WebSocket endpoint.
Core NFC logic unchanged, operations hardened
D3 Labs found the NFC and exfiltration logic largely unchanged. The changes are operational: more frequent APK rebuilds, brand rotation, URL shorteners, a new C2 endpoint and a 10-DEX layout.
The actor hosts payloads in a public GitHub repository named "app-scuola" (roughly "school app") with a decoy README. As of 5 June 2026 it held 57 commits dating from 10 April 2026, most with the message "Aggiornato tutto" ("Updated everything").
Malformed ZIP entries defeat naive extraction
Newer APKs contain ZIP entries rooted under /AndroidManifest.xml/, /classes.dex/ and /resources.arsc/. Simple tools may write these as absolute paths and fail. D3 Labs advises treating a failed extraction as a potential indicator of the new packaging.
Fake bank operators guide sideloading
Victims may receive an SMS or call from a fake bank operator who walks them through enabling installation from unknown sources to sideload the APK.
Detection should target code markers, not filenames
D3 Labs recommends that defenders focus on internal markers rather than the APK filename or C2 endpoint. These include the nfc.share.itnamteis namespace, the CardInfoitmanteis model, the MqttChannel enum and IsoDep-based code that sends an EMV PPSE select APDU. The combination of WebView UI, NFC reader use and outbound WebSocket connections is another signal. The open-source tool apkInspector can parse the malformed samples.
Mobile security teams are advised to block NFC reader permissions for sideloaded or unverified apps and to block known malicious domains at the DNS or proxy layer. Security teams should also monitor GitHub for public repositories hosting bank-themed APKs with suspicious commit patterns.