Cybersecurity researchers at Group-IB have identified a new Android malware family, dubbed WindRelay, designed to facilitate real-time contactless payment card fraud. This malware operates by capturing live NFC (Near Field Communication) data from a victim's physical bank card and relaying it instantly to an attacker-controlled device, which can then be used for fraudulent purchases or ATM withdrawals.
The attack typically begins with a sophisticated social engineering tactic, often involving a lengthy phone call where attackers impersonate a bank representative. In one observed instance, a 13-minute call persuaded a victim to install an Android application branded with the bank's name. This initial application was a remote access Trojan (RAT) known as SpyNote, which granted the attackers full remote control over the victim's smartphone.
Once SpyNote was installed, the attackers silently deployed WindRelay onto the device. They then remotely accessed the victim's legitimate banking application, initiating a loan in the victim's name. During this process, the victim was instructed to tap their physical payment card against their phone and enter its PIN. This action allowed WindRelay to intercept the dynamic, one-time cryptographic data generated by the contactless payment card and transmit it in real time to the criminals.
The critical aspect of this attack is the real-time relaying capability. Unlike static NFC signals, modern contactless payment cards generate unique, transaction-specific codes (cryptograms or tokens) that cannot be reused. WindRelay's ability to relay this data instantaneously is essential for bypassing these security measures. The coordinated phone call serves not only as the initial lure but also as a control channel, enabling attackers to guide the victim through the installation, card tap, and PIN entry at precise moments.
This method falls under a broader category of NFC relay fraud, sometimes referred to as "ghost tapping," and shares similarities with previously identified malware families like NGate and SuperCard X. However, the current campaign is notable for its integration with the SpyNote RAT, which provides the attackers with comprehensive remote control over the victim's device and facilitates the stealthy deployment of the relay malware.
To protect against such threats, individuals are advised to exercise extreme caution regarding unsolicited calls or messages, particularly those demanding urgent action. Banks will not request customers to install applications from unofficial sources, links in text messages, or browser downloads to secure their cards. Users should avoid "sideloading" apps from outside official app stores like Google Play and be wary of unexpected requests for Accessibility or device-control permissions.
It is also recommended to verify any suspicious requests by contacting financial institutions directly using official phone numbers, rather than numbers provided in potentially fraudulent communications. Never disclose personal details to unexpected callers or change banking details at their instruction. Employing an up-to-date, real-time anti-malware solution on mobile devices can help detect and block such threats. Malwarebytes for Android, for example, identifies SpyNote and WindRelay as Android/Trojan.NGate.ACRBCF9BBC3C1 and Android/Trojan.NGate.ACR2401245FC5, respectively.
