Android malware steals payment card data using previously unseen technique

I mean, this is "malware" in the obvious sense.

But it's not compromising anything Android is doing. (Though it's worth noting that things like this are why Apple restricts NFC).

It's just phishing at the end of the day. Something you should make users aware of, but not a security flaw of the device.

So they need to keep the victim's card next to one phone, and then they can use another internet connected phone elsewhere to make a purchase. Doesn't sound that scary to me. If they already have my card then does it matter how far away they can make a purchase?