SuperCard X Mobile Malware: How a New Android Threat Is Hijacking Contactless Payments

A newly discovered mobile malware platform known as SuperCard X is redefining the way cybercriminals exploit smartphones, posing a fresh challenge for banks, card issuers, and users alike. Unlike traditional banking trojans or phishing scams, this malware introduces a more advanced, subtle, and coordinated method of attack: near-field communication (NFC) relay manipulation.

Developed by a Chinese-speaking threat group, SuperCard X is categorized as a malware-as-a-service (MaaS) offering. In short, it's a cybercrime toolkit for hire. By leveraging NFC capabilities in Android smartphones, the malware enables attackers to capture card data and conduct fraudulent transactions—without physical access to the victim's card.

How the Scam Starts: Social Engineering at Its Core

The attack begins with a convincing social engineering campaign. Victims are sent deceptive messages—often via SMS or WhatsApp—claiming to be from their bank. These messages warn of suspicious activity and prompt recipients to call a specific number. The urgency and appearance of legitimacy push many to act without verifying the message's source.

What follows is a method known as Telephone-Oriented Attack Delivery (TOAD). On the call, scammers impersonate bank representatives and instruct the victim to install what they claim is a security app. In reality, it's one of several disguised versions of the SuperCard X malware, such as "Verifica Carta," "SuperCard X," or "KingCard NFC."

Once installed, the app requests sensitive permissions and establishes a link with the attacker's system. Victims are sometimes persuaded to reveal their PINs or remove daily account limits, which makes fraud much easier.

NFC: The New Frontier for Financial Fraud

The centerpiece of SuperCard X's capability is its novel use of NFC relay techniques. The attackers convince victims to physically place their credit or debit cards near their infected phones. The malware then silently reads the NFC data transmitted by the card and forwards it to an external server in real-time.

On the attacker's side, a companion app—nicknamed "Tapper"—emulates the card using the stolen information. The criminal can then use this virtual clone to withdraw cash at ATMs or pay at contactless terminals as if they were the legitimate cardholder.

This method is particularly effective for contactless ATMs and PoS systems, which rely on NFC data for authentication but cannot easily detect that the card has been cloned remotely.

The Infrastructure Behind the Scenes

SuperCard X is not just one app—it's an entire fraud ecosystem. Before distributing the malware, cybercriminals must create an account on the platform. Each instance of the malware is linked to this account, enabling communication between the infected user device (Reader) and the criminal's device (Tapper).

Interestingly, every Reader app appears to be customized for specific campaigns, with slight variations in their login interfaces. This suggests affiliate threat actors are tailoring the apps to target different regions or institutions.

Communication between devices is encrypted using mutual TLS (mTLS), a step up from the usual encryption standards seen in mobile malware. This added layer helps attackers stay under the radar by protecting their command-and-control (C2) traffic.

The Wider Implications

What makes SuperCard X particularly concerning isn't just its technical ingenuity but its implications for the broader financial ecosystem. By bypassing traditional online authentication and going straight for contactless infrastructure, it opens up a relatively unguarded attack surface.

Although this campaign has so far been focused on Italy, the underlying techniques could easily spread to other countries. Payment providers, financial institutions, and mobile OS developers are all potential stakeholders in the fight to contain this threat.

In response, Google is reportedly working on new Android features to mitigate such risks. These include restrictions on installing apps from unknown sources or granting sensitive permissions like accessibility access—especially while on a call when TOAD attacks typically occur.

Staying Safe: Practical Tips for Users

At this point, SuperCard X is not distributed via the Google Play Store, but that doesn't mean it's not a risk. Users should remain cautious about installing apps from third-party sources, especially if prompted to do so during a phone call. Here are a few key precautions:

• Avoid installing apps from unknown sources unless absolutely necessary.
• Be skeptical of urgent messages claiming to be from banks—verify them through official channels.
• Keep Google Play Protect enabled to detect potentially harmful apps.
• Scrutinize app permissions and check reviews before installing anything new.

SuperCard X represents a leap forward in mobile-enabled financial fraud, blending manipulation, technical sophistication, and stealth. While the malware is currently limited in scope, its potential impact is vast—making awareness and vigilance the best first lines of defense.