Wind Relay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud
Summary: Group-IB documented a previously unseen Android NFC relay malware family called WindRelay, first detected in the wild in late August 2025, deployed alongside the SpyNote remote access trojan to capture live card data and stream it to fraudsters in real time. SpyNote's Accessibility Service access lets the fraudster silently sideload and activate the NFC app with no screen sharing triggered, and victims are lured through phishing, smishing, or vishing into tapping their physical payment card against their own infected phone under the pretext of identity verification or a PIN change.
What you should know: The researchers describe a single session combining a live social engineering call, a personalized RAT for remote device control, and NFC relay malware for physical cashout, hitting two payout channels - a digital loan and card-present purchases - before the bank or victim could react. Twenty-three WindRelay samples were uploaded to VirusTotal between November 2025 and July 2026, impersonating financial institutions in Czechia, Slovakia, and Slovenia.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026