A new Android malware family called WindRelay is being used with the SpyNote remote access trojan (RAT) to steal money through live NFC card-relay fraud.
The operation combines phone-based social engineering, remote device control, and contactless payment abuse in one fast-moving attack.
The campaign shows how fraudsters no longer need a victim’s physical card. Instead, they convince targets to tap their bank card against an infected Android phone.
WindRelay then captures and relays the live NFC exchange to an attacker-controlled device, allowing fraudulent in-store payments or ATM withdrawals.
NFC relay fraud is growing quickly. Kaspersky reported that NFC-based Android attacks rose 188% in the first four months of 2026 compared with the same period in 2025.
The technique works by placing malicious devices between a real payment card and a legitimate terminal, relaying the transaction data in real time.me-en.
WindRelay and SpyNote Attack
In the observed case, the fraud began with a phone call from an attacker posing as a bank employee. The caller claimed there was a problem with the victim’s payment card and instructed them to install an Android application.
That first app was a personalized SpyNote RAT. Rather than using a generic label, the malware reportedly displayed the victim’s own name.
This detail can make a malicious application appear more trustworthy and suggests that the operators had basic personal information before calling.
SpyNote is a well-known Android RAT capable of extensive surveillance, data theft, and remote device manipulation.
It has been associated with abuse of Accessibility Services, SMS and contact theft, audio recording, keylogging, and other intrusive functions.
Its remote-control capabilities can also allow attackers to operate device features without conventional screen-sharing software.malpedia.caad.fkie.
Once SpyNote was active, the fraudster installed WindRelay remotely.
This removed the need for the victim to download or approve the second malware sample directly. The attacker could then guide the victim through the remaining steps during the same live call.
The campaign also demonstrates a dual-fraud model. While controlling the banking app through SpyNote, the threat actor allegedly applied for a loan in the victim’s name.
WindRelay was then used to enable card-present fraud, maximizing the financial impact before the victim or bank could react. WindRelay is purpose-built for NFC relay attacks.
It requests permissions that support its role, including NFC access to communicate with a contactless card and internet access to transmit the captured payment exchange in real time, group-ib said.
The victim is instructed to hold their bank card against the compromised phone and enter the card PIN. Instead of simply copying a card number, the malware relays the live communication between the chip and a payment terminal.
An attacker’s second device can present the transaction to a real merchant terminal or ATM while the victim’s physical card is still involved in the authentication process.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
 to steal money through live NFC){kind=link}