New Android malware relays bank cards to fraudsters while victims still hold them
Group-IB discovered WindRelay Android malware that streams NFC card data in real time, paired with SpyNote RAT, targeting Czechia, Slovakia, and Slovenia.
Group-IB identified WindRelay, an Android malware that uses NFC to communicate with victims' payment cards and relays the exchange live to attacker-controlled terminals. Fraudsters impersonate bank staff by phone, trick victims into installing a personalized SpyNote RAT, then silently deploy WindRelay to cash out using the victim-entered PIN. Researchers traced 23 samples on VirusTotal from November 2025 to July 2026, four C2 IPs, and campaigns against Czechia, Slovakia, and Slovenia. No affected apps were found on Google Play, and Google Play Protect detects known versions.
- WindRelay streams NFC card exchanges to a fake merchant terminal in real time.
- SpyNote app labels show the victim's own name to lower suspicion during calls.
- During one 13-minute call, the fraudster took a loan and streamed card data.
- 23 samples on VirusTotal; four C2 IPs identified; no Google Play distribution.
From the original article
2 min read at helpnetsecurity.com
Group-IB researchers discovered WindRelay, a new Android malware built to capture live payment card data over NFC (Near Field Communication) and relay it to attackers in real time. WindRelay is paired with the SpyNote remote access trojan, which gives attackers remote access to a victim’s device.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.