Attackers are abusing a modified Android NFC app to steal payment card data and PINs for contactless fraud and ATM cash-outs.