A newly discovered malicious Android application named VIPER is being sold on dark web cybercrime forums. This mobile tool abuses legitimate NFC APIs to scan, capture, and clone physical credit card data, operating invisibly in the background with automatic persistence.
Defenders managing enterprise mobile fleets must immediately audit active application permissions and restrict the sideloading of third-party Android application packages (APKs) to contain the threat of localized credential and financial data harvesting. The immediate focus for security teams must be the verification of mobile device management (MDM) profiles to ensure that unknown installation sources are completely disabled across all corporate-owned and personally-enabled (BYOD) devices. Because these exploits bypass traditional perimeter barriers, real-time posture validation represents the first line of active containment.
This operational warning follows the discovery of advertisements on underground cybercrime forums such as CrackingX and Niflheim World for a malicious tool named VIPER Malicious NFC App. Developed and sold by the threat actor known as ViperSoftwares, this specialized malware targets Android systems to scan, capture, and clone physical payment card data. Security operations center (SOC) analysts should treat this development as a significant evolution in mobile-based financial extraction techniques, requiring targeted threat hunting and strict asset inventory reviews.
High-risk Android threat leveraging Host Card Emulation to harvest physical contactless card records.
The threat actor behind this release, operating under the alias ViperSoftwares, has been active in underground ecosystems since at least April 2024. This adversary has established a reputation for building mobile exploitation tools, previously distributing the VIPER Android RAT and the VIPER Multi-OS Botnet. The launch of the VIPER Malicious NFC variant on April 2, 2026, marks an expansion of their portfolio into physical-proximity harvesting, showcasing a deliberate transition from purely remote credential theft to hybrid attacks that bridge the digital and physical domains.
Unlike standard info-stealers, the VIPER Malicious NFC App focuses heavily on abusing legitimate Near Field Communication (NFC) protocols. The author actively markets the utility on channels like Telegram, appealing to lower-tier cybercriminals by promising a turnkey command-and-control (C2) administration panel. This commercialization of specialized proximity-sniffing software lowers the technical barrier to entry, increasing the likelihood that regional organizations will encounter localized compromise attempts in high-traffic environments.
The operational flow of a VIPER infection is structured to run silently, prioritizing sustained persistence over immediate, loud activity. Understanding the step-by-step progression of this malware allows enterprise defenders to align their network and endpoint detection controls effectively.
The primary vector for VIPER is social engineering, typically executed through SMS phishing (smishing) campaigns or rogue messaging applications on platforms like WhatsApp. Targets are lured into sideloading custom APK packages disguised as critical banking updates, localized service tools, or essential system patches. These social engineering lures are frequently tailored to match regional institutions, bypassing the security scrutiny of official app repositories.
Once the victim manually executes the malicious APK, the application requests standard but highly sensitive permissions, specifically android.permission.NFC and android.permission.RECEIVE_BOOT_COMPLETED. To maintain persistent access, the app registers a background broadcast receiver that listens for the system boot broadcast. This ensures the service initializes automatically upon device restart, running continuously without requiring the user to reopen the visual interface.
To avoid discovery during manual inspections, VIPER instantly hides its launcher icon from the Android application drawer after initialization. The malware functions as a persistent background service, manipulating system alerts and overlays to obscure its execution. By running silently, the app avoids drawing visual attention or triggering standard battery-drain alerts, allowing it to reside on the device undetected for extended periods.
The core capability of the VIPER application lies in its abuse of Android's Host Card Emulation (HCE) and NFC polling APIs. When a physical contactless credit or debit card is brought within physical proximity of the infected mobile device, the malware initiates an unauthorized read operation. It extracts critical Track 1 and Track 2 payment card data, including the Primary Account Number (PAN), cardholder name, and expiration dates. This data is structured and stored locally in an encrypted state, awaiting transmission.
At structured intervals, the background service establishes outbound connections to the threat actor's command-and-control infrastructure. Using encrypted HTTP or HTTPS protocols, the gathered financial profiles are exfiltrated directly to a centralized web panel managed by the purchaser. The attacker can then use this data to perform fraudulent online transactions or write the stolen track information onto blank physical cards for direct card cloning.
Social engineering via SMS/WhatsApp links leading to sideloaded custom APKs.
Manual installation requesting NFC access and boot-completion broadcast receiver registration.
Launcher icon is hidden immediately after execution to run invisibly as a background service.
Device scans physical credit/debit cards within proximity, extracting Track 1 & Track 2 EMV records.
Harvested cards are cached and transmitted over encrypted channels to the actor's admin panel.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
The commercial sale of SpyNote Pro Android RAT on underground forums highlights a growing mobile threat. Discover how this malware abuses accessibility services, performs dynamic payload execution, and executes overlay attacks to steal sensitive corporate credentials and bypass multi-factor authentication.
The alleged sale of the Stealc_v2 information-stealing malware source code on the exploit.in forum introduces major corporate security challenges. Featuring a PHP administration panel, customizable builders, and Telegram bot integrations, this leak enables rapid deployment of stealthy credential-harvesting campaigns.
June 25, 2026
A threat actor is selling the source code of the Predator 1.6 remote access trojan and file binder on the cybercrime forum Spear. This development lowers the technical barrier for deploying persistent backdoors, posing immediate security risks that demand behavioral EDR rules and path restrictions.
Analyzing the underlying architecture of VIPER reveals how modern mobile malware utilizes legitimate operating system features to bypass security controls. Rather than relying on zero-day vulnerabilities, this malware exploits the open nature of the Android permission model to turn a smartphone into an offensive physical scanner.
The abuse of the android.permission.NFC API is central to this mechanism. Legitimate contactless payment applications use this API to transmit card details to payment terminals. VIPER reverses this flow, configuring the mobile device to act as a terminal reader. This technique allows the device to capture unencrypted track information from passing cards. The software maps directly to several key techniques within the MITRE ATT&CK Mobile Matrix:
T1624.001 (Event Triggered Execution: Broadcast Receivers): Leveraged by the application to achieve boot persistence, ensuring that malicious background tasks resume immediately upon device startup.
T1636 (Credentials from Mobile Devices / Card Data): Executed through continuous background polling of the physical NFC reader to capture sensitive Track 1 and Track 2 EMV payment records.
T1406 (Obfuscated Files or Information): Utilized during the installation phase to strip user-facing icons, masking the active background process from the standard operating system task list.
T1573 (Encrypted Channel): Implemented to transmit exfiltrated credit card details to the remote administration panel over TLS/SSL, preventing simple network-sniffing tools from alerting defenders.
By blending into normal system operations, the malware presents a high detection challenge for standard signature-based endpoint protection tools on mobile devices. This highlights the absolute necessity of behavioral monitoring and permission governance inside the enterprise.
For organizations operating across the GCC region, particularly in financial hubs like Dubai, Riyadh, and Doha, the proliferation of modular NFC-harvesting malware presents acute risks. Corporate-owned mobile devices carried by field workers, logistics personnel, or executives are prime targets. If compromised, these endpoints turn into walking scanners capable of capturing physical card data from employees or clients in public spaces.
The regulatory and compliance consequences of such an exposure are severe. Under frameworks like the Payment Card Industry Data Security Standard (PCI-DSS), organizations are required to protect transaction environments. A single infected corporate device capturing nearby cardholder data can trigger non-compliance penalties, costly forensic audits, and significant reputational damage. Furthermore, organizations seeking alignment with regional bodies or preparing for vCISO for VARA Compliance in Web3 spaces must realize that hardware-level endpoint security is directly tied to overall transactional integrity.
To reduce the overall attack surface, security teams should combine robust endpoint protection with comprehensive Attack Surface Management. Identifying exposed digital assets and untrusted endpoints prevents threat actors from gaining the initial footholds needed to distribute their malicious APK payloads.
Active defense against VIPER requires a structured approach across detection engineering, immediate device validation, and rapid containment playbooks.
Security operations centers can deploy specialized YARA rules to inspect suspicious APKs extracted from corporate environments or identified during boundary-level file transfers. The following signature targets specific permission strings and package indicators associated with the VIPER family:
rule Detect_VIPER_NFC_Malware_Manifest {
meta:
description = "Detects Android Manifest signatures commonly used by VIPER NFC/RAT malware"
author = "FemtoSec Threat Intelligence"
date = "2026-06-26"
strings:
$perm_nfc = "android.permission.NFC"
$perm_boot = "android.permission.RECEIVE_BOOT_COMPLETED"
$viper_str = "viper" nocase
condition:
uint32(0) == 0x04034b50 and ($perm_nfc and $perm_boot) and ($viper_str)
}If an endpoint is suspected of carrying a malicious background service, responders must follow a disciplined forensic validation protocol:
Isolate: Immediately place the device into Airplane Mode, disabling cellular, Wi-Fi, and NFC radios to stop ongoing exfiltration.
ADB Query: Connect the device to a secure analysis workstation and use the Android Debug Bridge (ADB) to inspect the installed package list:
adb shell pm list packages -fPull APK: Extract the target application package for deep inspection:
adb pull /data/app/[package_name]/base.apkStatic Analysis: Import the APK into a secure sandbox environment such as Mobile Security Framework (MobSF) or JADX to inspect the decompiled source for unauthorized NfcAdapter classes or hardcoded command-and-control domains like viperrat.com.
If a compromise is validated, immediate containment actions are mandatory. Revoke the device's enterprise access tokens, wipe the device via MDM policies, and mandate a full hardware factory reset. All credit and debit cards physically handled near the compromised device must be immediately frozen and reissued to prevent fraudulent transactions.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
For advanced offensive validation of your system’s resilience against mobile and credential-based attacks, consider scheduling a comprehensive Penetration Testing engagement to secure your infrastructure against emerging threat vectors.