A new Android malware, dubbed WindRelay, has been identified as capable of intercepting live payment card data via Near Field Communication (NFC) and transmitting it to attackers in real time. Discovered by Group-IB researchers, WindRelay operates in conjunction with the SpyNote remote access trojan (RAT), which grants attackers control over a victim's device.
The attack typically begins with a social engineering phone call where the fraudster impersonates a bank representative, claiming an issue with the victim's card. During this call, the victim is guided to install an application, which is in fact SpyNote. To enhance credibility, the SpyNote builder toolkit allows attackers to customize the app's label, name, and package, often displaying the victim's own name rather than a generic one.
Once SpyNote is installed and provides remote access, the attacker then installs WindRelay onto the device without further victim interaction. WindRelay leverages NFC to communicate with payment cards and uses the device's internet connection to relay transaction data as it occurs. It also requests access to the victim's contacts and an unusual system-inspection permission for a third-party application.
In one observed incident, a 13-minute phone call resulted in the victim installing the RAT. Subsequently, the fraudster used remote access to secure a loan in the victim's name through their mobile banking app and streamed card data to a fraudulent merchant terminal. All transactions were approved using the PIN the victim had entered themselves, with the victim remaining on the call throughout the entire process. Card transactions began appearing on the victim's account shortly after the call concluded.
Group-IB researchers found 23 samples of WindRelay uploaded to VirusTotal between November 2025 and July 2026. These samples were linked to campaigns primarily targeting individuals in Czechia, Slovakia, and Slovenia. Four command-and-control IP addresses associated with the NFC relay activity were also identified. Several samples featured victim-specific names and interface text localized to the target country, indicating a tailored approach for individual victims and regions.
This sophisticated fraud scheme combines social engineering, personalized remote access, and NFC relay malware for physical cash-out, highlighting a multi-faceted approach to cybercrime.
