A live phone call, a personalized RAT, and NFC relay malware all worked together in a new Android fraud scheme documented by Group-IB. The malware, called WindRelay, captures payment card data over near-field communication and streams it to fraudsters in real time while victims keep physical possession of their cards.
The attack begins with a call from someone impersonating the victim’s bank. The fraudster walks the victim through installing an app themselves, usually a SpyNote remote access trojan build whose label displays the victim’s own name to seem legitimate. SpyNote’s builder toolkit lets an operator tailor the label, name, and package for each target before deployment, Group-IB said.
WindRelay arrives silently once SpyNote has taken hold. It reads the payment card over NFC and relays that exchange over the internet as it happens, while requesting access to contacts and a system-inspection permission that is unusual for a third-party app.
One documented incident ran 13 minutes. The fraudster drained the victim’s banking app through remote access, took out a loan in their name, and streamed card data to a fake merchant terminal. Every transaction cleared using the PIN the victim had typed in themselves, and charges showed up on the account not long after.
Group-IB tallied 23 WindRelay samples on VirusTotal, submitted between November 2025 and July 2026. Campaigns targeted victims in Czechia, Slovakia, and Slovenia, with four command-and-control IP addresses tied to the NFC relay activity. Several samples displayed victim-specific names and interface text in the target’s native language, a sign of per-target tailoring.
The case is a reminder that modern fraud stacks techniques rather than relying on one. For users, the defense is simple: hang up on unsolicited calls claiming to be from a bank, never install apps at a caller’s direction, and keep contactless verification enabled.
