A new NFC relay malware, dubbed WindRelay, has been observed in the wild, operating in conjunction with a variant of the SpyNote remote access trojan (RAT) to facilitate real-time financial fraud. Cybersecurity researchers at Group-IB documented a specific incident where a fraudster used this combination during a 13-minute phone call to steal a victim's card data and secure a loan in their name.
The attack begins with a phone call where the fraudster impersonates a bank employee, claiming there's an issue with the victim's card. The victim is then guided to install an initial application. This application, identified as a SpyNote RAT variant, is sideloaded onto the device via the standard package installer, bypassing official app stores. Notably, the app's label was customized to display the victim's own name, a tactic made possible by SpyNote's builder toolkit which allows operators to set custom app names and package names. This personalization suggests prior reconnaissance by the attackers to gather the victim's name and phone number, aiming to reduce suspicion.
Once the SpyNote RAT is active, the fraudster leverages its remote access capabilities to install WindRelay without further interaction from the victim. Critically, no screen sharing was initiated during this process, making it harder for the victim to detect the ongoing malicious activity.
WindRelay's permissions reveal its intended functionality, including NFC access to read card data, internet access to stream captured information, and READ_CONTACTS to potentially target other individuals. An unusual permission, DUMP, was also observed, allowing the malware to inspect the device's state.
During the call, the victim is instructed to tap their physical card. WindRelay then acts as a contactless reader, capturing the live exchange between the card chip and a payment terminal, including the one-time transaction code. This captured data is simultaneously streamed to a second device controlled by the fraudster, which then presents itself as the victim's card to a legitimate payment terminal, enabling unauthorized transactions.
In the documented incident, the fraudster also exploited the remote access provided by SpyNote to take out a loan through the victim's banking application. Researchers believe this was an opportunistic action rather than a pre-planned step in the scam. Shortly after the call concluded, unauthorized card transactions began appearing.
Group-IB has identified 23 samples of WindRelay uploaded to VirusTotal between November 2025 and July 2026. These samples were found to impersonate financial institutions in Czechia, Slovakia, and Slovenia.
To mitigate the risk of such scams, Group-IB recommends that users should not rely on screen-sharing detection as the sole indicator of remote access, should be wary of app installations from unofficial sources during active phone calls, and that financial institutions should flag loan disbursements that coincide with physical card transactions.
