What NFC tag type is used for storing plain-text NDEF messages and what payload attack can be performed using a malicious NFC tag?

• A.NFC tags carry a WPA3 handshake before any record is read, and a reader without the passphrase gets nothing because the tag refuses the exchange; a malicious payload therefore stays unreachable on a stock handset.
• B.Type 1 tags are the sole NDEF carrier, and a malicious tag injects a Bluetooth pairing command because the record type maps to a pairing intent; the handset bonds silently with the attacker's peripheral.
• C.NFC Forum Type 2 and Type 4 tags can store NDEF records including URI records; a malicious tag can embed a URI pointing to a drive-by download or phishing site, which some Android versions automatically open in a browser when the tag is tapped.
• D.NFC tags exchange vCard records alone, and a browser action is outside the format because NDEF defines contact data exclusively; the worst a malicious tag achieves is an unwanted contact entry.