Published on November 5, 2026
Fake BNM Mobile Security Android App Steals Banking Information and Enables Fraudulent Transactions via NFC Relay Attack
Severity
High
The Malaysia Computer Emergency Response Team (MyCERT) has issued a security advisory regarding an active Android banking malware campaign involving a fraudulent application named “BNM Mobile Security”, which impersonates Bank Negara Malaysia (BNM). The malicious application is distributed through a fake website, bnmgov[.]my[.]id, designed to resemble BNM’s Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT) portal.
The campaign targets Android users through social engineering and malicious application distribution, aiming to steal sensitive personal and banking information. The malware also abuses Near Field Communication (NFC) technology to facilitate unauthorized financial transactions through NFC relay attacks, commonly known as “ghost-tap” attacks.
According to MyCERT’s technical analysis, the malicious application uses a commercial software packer known as dpt-shell to conceal its malicious code. It also incorporates an EMV card reader and communicates with attacker-controlled command-and-control (C2) infrastructure through encrypted WebSocket connections.
Successful attacks could result in unauthorized contactless payments, ATM withdrawals, financial losses, and exposure of sensitive personal and banking information. MyCERT has urged users and financial institutions to remain vigilant and strengthen security measures against this emerging mobile banking threat.
How?
The attack begins when victims receive fraudulent phone calls from individuals impersonating Bank Negara Malaysia (BNM) officials, claiming that their bank accounts are linked to money laundering activities and require immediate verification. Victims are then directed to a fraudulent website, bnmgov[.]my[.]id, where they are instructed to download and install a malicious Android application named “BNM Mobile Security” (com.client.bnm).
Once installed, the application displays a fake account verification page requesting sensitive personal information, including the victim’s name, identification card or passport number, phone number, and email address. A subsequent security notice falsely identifies the victim’s bank account as high-risk and requests additional financial information, including bank account balances, credit limits, and six-digit payment card PINs under the pretext of verifying card ownership.
The application then instructs victims to tap their physical bank cards against their smartphones through a “Pair Your Card” feature. In the background, the malware uses the device’s Near Field Communication (NFC) functionality to read and relay payment card communications in real time to an attacker-controlled payment device. Misleading error messages, such as “Card Not Supported” or “Try Again,” encourage victims to repeatedly tap their cards or attempt verification using other bank cards.
Successful exploitation may allow attackers to conduct unauthorized contactless purchases or ATM withdrawals using the relayed card communications and stolen PINs, potentially resulting in financial losses and exposure of sensitive personal and banking information.
IOC
Network
| Type | Value |
| Distribution domain | bnmgov[.]my[.]id (104.21.88.8, 172.67.149.226) |
| Payload URL | hxxps://bnmgov[.]my[.]id/dl/downloads/app-d1fe8fc2bb83.apk |
| C2 server | ws.mobilesecurity[.]eu[.]cc (172.86.82.166) |
| App package | com.client.bnm (“BNM Mobile Security”, v2.5.7) |
File hashes
| File | SHA-256 |
| app-d1fe8fc2bb83.apk | d1fe8fc2bb83d4953e05ea1dfffeddee716abbaf4854db7a90dbc2ed0a4f4b25 |
| Shell classes.dex | 8537c7828986f414afa651c7f9f6a07b16ac3d7d669367cdec7b25516b8b48f0 |
| Inner app DEX | 622a9e6954b88792efa71e768e91bda2efa4ffc3391f603e9bed5baaa1d1a318 |
| Native library (arm64) | afeb45756016107ba999b96da55014517d9dfdf47545d3f4b0230a2e33623d19 |
| WebView panel JS | 99b862d7d7f6085c7257b0c487fbb1583fec342094a20d5dc60c7dbffaf90e87 |
Behavioural
- App named “BNM Mobile Security” requesting NFC access and asking users to tap bank cards.
- App or website asking for a card PIN, balance or credit limit; BNM and banks never do this.
- Contactless payments or ATM withdrawals occurring shortly after a “BNM/police” phone call.
Conclusion
The emergence of the fraudulent “BNM Mobile Security” Android application highlights the increasing sophistication of mobile banking threats targeting Malaysian users. By combining social engineering, financial authority impersonation, credential harvesting, and NFC relay technology, attackers can potentially conduct unauthorized financial transactions without physically possessing victims’ payment cards.
Organizations and financial institutions should strengthen fraud detection capabilities, monitor suspicious network and transaction activities, and promote cybersecurity awareness to reduce the risk of financial losses. Users are strongly advised to avoid installing applications from untrusted sources, never disclose their banking PINs, and report suspicious activities immediately.
Source