Lisbon is hosting the fourth edition of NFC Summit this week, running from June 4 to June 6 and is expected to draw around 5,000 participants per day to Pavilhão Carlos Lopes.

This year’s event reflects a growing shift in the web3 industry—from trading and speculation to applications in culture, media, and entertainment. Organisers have positioned the summit as a multi-disciplinary gathering, with programming designed to appeal to professionals from creative industries as well as those working in blockchain development.

A single pass grants access to eight major events focused on themes such as digital art, gaming, decentralised platforms, artificial intelligence, and online communities.

What is NFC Summit?

NFC Summit (short for Non-Fungible Conference) began as a web3-focused event in 2022. Initially centred on NFTs and digital ownership, it has since expanded to include a broader range of topics related to blockchain technology and digital creativity.

It is held annually in Lisbon and attracts attendees from across Europe and beyond, including representatives of technology firms, creative professionals, and web3 communities. Previous editions have focused heavily on art and innovation, with a strong presence from digital creators and platform developers.

Now in its fourth year, NFC Summit has evolved into a hybrid format that combines panel discussions and industry talks with exhibitions, performances, and community gatherings.

What can we expect from NFC Summit 2025?

The main programming will take place on a 360-degree stage inside the Pavilhão Carlos Lopes and is intended to allow for flexible formats, including roundtable discussions, presentations, and performances.

The list of confirmed participants includes OpenSea, The Sandbox, Tezos, CoinMarketCap, and football club S.L. Benfica. Digital artists Claire Silver, Sam Spratt, and FvckRender are also among the creatives featured in this year’s programme.

This year’s event features eight core programmes with each having a specific focus and is open to all attendees through a single registration. Key events include:

• Memecon: A series of talks and sessions examining internet culture and its role in the crypto space
• Ordinals Lisbon: Exploring Bitcoin Ordinals and their relationship with Ethereum-based digital art
• AIFA Awards: A digital film and animation award programme led by Clare Maguire and Leo Crane
• TON of People: A gathering for developers, users, and communities connected to the TON blockchain
• Chilibangs Fest: A series of community-led events from a web3 collective known for global meetups
• Red Beard x 100C: A live stage show featuring interviews with artists and performers
• Music Beach Festival: Final evening at Costa da Caparica, featuring music and informal networking

Additional sessions on artificial intelligence, social applications of blockchain, gaming, and tokenisation of real-world assets are also part of the agenda.

Interested participants may visit the official NFC Summit website for a full detailed agenda.

A new malware-as-a-service (MaaS) platform named ‘SuperCard X’ has emerged, targeting Android devices via NFC relay attacks that enable point-of-sale and ATM transactions using compromised payment card data.

SuperCard X is linked to Chinese-speaking threat actors and shows code similarities with the open-source project NFCGate and its malicious spawn, NGate, which has facilitated attacks in Europe since last year.

The malware-as-a-service platform is promoted through Telegram channels that also offer direct support to “customers.”

SuperCard X was discovered by mobile security firm Cleafy, which reports seeing attacks utilizing this Android malware in Italy. These attacks involved multiple samples with subtle differences, indicating that affiliates are offered the option of custom builds tailored to regional or other specific needs. 

How SuperCard X attacks unfold

The attack begins with the victim receiving a fake SMS or WhatsApp message impersonating their bank, claiming they need to call a number to resolve issues caused by a suspicious transaction.

The call is answered by a scammer posing as bank support, who uses social engineering to trick the victim into “confirming” their card number and PIN. They then attempt to convince the user to remove spending limits via their banking app.

Finally, the threat actors convince users to install a malicious app (Reader) disguised as a security or verification tool that contains the SuperCard X malware.

Upon installation, the Reader app requests only minimal permissions, mainly access to the NFC module, which is enough to perform the data theft.

The scammer instructs the victim to tap their payment card to their phone to verify their cards, allowing the malware to read the card chip data and send it to the attackers.

The attackers receive this data on their Android device, which runs another app called Tapper, which emulates the victim’s card using the stolen data.

These ’emulated’ cards allow attackers to make contactless payments at stores and ATM withdrawals, though amount limits apply. As these small transactions are instant and appear legitimate to the banks, they’re harder to flag and reverse.

Evasive malware

Cleafy notes that SuperCard X is currently not flagged by any antivirus engines on VirusTotal and the absence of risky permission requests and aggressive attack features like screen overlaying ensures it stays off the radar of heuristic scans.

The emulation of the card is ATR-based (Answer to Reset), which makes the card appear legitimate to payment terminals and shows technical maturity and understanding of smartcard protocols.

Another notable technical aspect is the use of mutual TLS (mTLS) for certificate-based client/server authentication, securing C2 communications from interception and analysis by researchers or law enforcement.

BleepingComputer contacted Google to comment on the SuperCard X activity and a spokesperson sent the below statement.

“Based on our current detection, no apps containing this malware are found on Google Play. Android users are automatically protected by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.” – A Google spokesperson