RelayNFC The New NFC Relay Malware Targeting Brazil

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://cyble.com/blog/relaynfc-nfc-relay-malware-targeting-brazil/
• Blog Title: RelayNFC: The New NFC Relay Malware Targeting Brazil
• Suggested Section: 😎 Hardware/Physical Access -> New page on NFC/EMV relay attacks (cross-linked from 📱 Mobile Pentesting / Android)

🎯 Content Summary

The blog presents an in-depth technical analysis of RelayNFC, a newly observed Android malware family used for NFC relay attacks to perform fraudulent EMV contactless payments, currently targeting Brazilian users via localized phishing campaigns.

Campaign & delivery
CRIL tracked a coordinated phishing operation using Portuguese-language websites that impersonate card security services and prompt users to “secure” their payment cards by installing an Andro...

🔧 Technical Details

1. Turning an Android device into a remote EMV reader via WebSocket APDU relay
The key trick is to use a compromised Android phone as a network-controlled NFC reader. The malware opens a persistent WebSocket to a C2 server (over a non-standard port such as 3000) and identifies itself with a JSON hello message including role: "reader" and a device UUID. The attacker’s POS emulator then sends "type": "apdu" messages like:
{"type":"apdu","id":1,"sessionId":"abc","data":"00A40400"}
The malware decodes data from hex, forwards the APDU via the phone’s NFC subsystem to a tapped card, captures the response, and returns it as "apdu-resp" with matching id and sessionId (e.g., {"type":"apdu-resp","id":1,"sessionId":"abc","data":"9000"}). By maintaining this low-latency, bidirectional APDU tunnel, an attacker can drive the EMV state machine remotely while the...

🤖 Agent Actions

Summary:

• Expanded android-hce-nfc-emv-relay-attacks.md with a detailed RelayNFC case study covering React Native/Hermes staging tricks, the reader-mode WebSocket APDU tunnel, GUI PIN phishing workflow, and the in-progress HCE relay implementation plus actionable detection guidance.
• Added Cyble’s RelayNFC research to the References section to credit the new technical details.

Tests: Not run (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 913
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://cyble.com/blog/relaynfc-nfc-relay-malware-targeting-brazil/

Content Categories: Based on the analysis, this content was categorized under "😎 Hardware/Physical Access -> New page on NFC/EMV relay attacks (cross-linked from 📱 Mobile Pentesting / Android)".

Repository Maintenance:

• MD Files Formatting: 913 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0