How hackers steal money from phones via NFC: The new SuperCard threat

In May 2025, analysts from F6, a company specializing in combating financial fraud, recorded the first cyberattacks on Russian bank customers using malware called SuperCard. According to Gazeta.Ru, which cited the company’s press service, SuperCard enables cybercriminals to intercept NFC traffic and steal bank card data, leading to unauthorized withdrawals from accounts.

The attacks began a month after the Italian cybersecurity firm Cleafy identified the SuperCard X malware-as-a-service (MaaS) platform in April 2025. Initially reported in Italy, the wave of attacks soon reached Russia — and there is a high probability that this threat could also spread to Armenia.

How SuperCard Works

SuperCard is distributed via malicious APK files downloaded by users deceived through social engineering tactics. Attackers trick victims into installing what appears to be a legitimate app. Once installed, the malware intercepts NFC data, enabling cybercriminals to carry out unauthorized transactions.

Unlike previous NFC-based malware like NFCGate, SuperCard is actively advertised on Telegram channels — including Chinese-language ones — and comes with full technical support. The malware supports at least Chinese and English and was initially used to target users of major banks in the U.S., Australia, and Europe. Its lack of geographical restrictions made its spread to Russia only a matter of time.

The Scale of the Threat in Russia

According to F6, cybercriminals are testing SuperCard on Russian users, similar to how earlier NFCGate versions were deployed. In the first quarter of 2025 alone, NFCGate-related losses in Russia totaled 432 million rubles, and over 175,000 Android devices were compromised. Analysts note that SuperCard differs from NFCGate in both functionality and code structure, suggesting it was developed by a separate cybercriminal group.

Potential Threat to Armenia

Given that SuperCard has no geographical limitations, it is highly likely that the malware could affect Armenia. The widespread use of NFC-based contactless payments in the country makes users vulnerable to similar attacks. The use of Telegram channels for distribution, coupled with phishing tactics and fake apps, makes it easy for the threat to adapt to the Armenian market — especially considering the popularity of Android devices and messaging apps in the region.

Although no SuperCard-related attacks have yet been reported in Armenia, cybersecurity experts urge caution. Only downloading apps from trusted sources like Google Play and being vigilant about suspicious messages can reduce infection risks. Additionally, Armenian banks are advised to enhance transaction monitoring and proactively inform clients about potential threats.

Recommendations for Users

To protect yourself from SuperCard attacks, F6 experts recommend:

• Only install apps from official stores (Google Play, App Store).
• Ignore suspicious links and messages prompting you to download unknown software.
• Regularly update your OS and apps to patch vulnerabilities.
• Use antivirus software with malware protection.
• Turn off NFC when not in use.

Conclusion

The emergence of SuperCard poses a serious threat to smartphone users who rely on NFC for payments. Having started in Russia, the malware could easily spread to other countries, including Armenia, due to the adaptable and international methods used by cybercriminals. Users must stay alert, and banks and cybersecurity firms should strengthen their defenses to minimize the risk of financial losses.