A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal card data and send it to attackers in real time.

In an incident investigated by the cybersecurity company Group-IB, a fraudster impersonated a bank employee and called the victim under the pretense of a problem with their payment card.

During the call, the threat actor instructed the victim to sideload the SpyNote RAT disguised as a legitimate app and grant it Accessibility Service permissions, giving the attacker remote access to the Android device.

To add credibility, the attacker personalized the malicious app label with the victim's name.

After gaining remote access to the device through SpyNote, the attacker installed WindRelay without further interaction with the victim and used the banking app to take out a loan in the victim’s name.

Additionally, the victim was instructed to tap their payment card on the phone and enter their PIN. WindRelay turned the phone into a fraudulent contactless reader and relayed the live NFC (near-field communication) exchange, including the card’s transaction-specific authentication data, to the attacker’s device.

This allowed the attacker to use the card data for purchases at a genuine payment terminal.

Group-IB says that the entire activity occurred in a 13-minute phone call, and transactions were approved using the PIN provided by the victim.

The researchers highlight that the combination of SpyNote and WindRelay may indicate a toolkit that provides both access to the victim's device for banking transactions and a direct cash-out channel.

Also, in contrast to most modern Android malware with live screen sharing and VNC features, this malware mix enabled the attackers to commit fraud solely through social engineering over the phone.

Android NFC malware is a growing problem, as shown by malware families such as NFCShare, NGate, SuperCard X, and RelayNFC.

In a typical attack, the victim installs a malicious app and grants it access to NFC. The attacker then uses social engineering to trick the victim into tapping their payment card against the compromised phone.

The phone uses its NFC interface to communicate with a contactless payment card and capture available data, which it then transmits over the internet to an attacker-controlled device.

Depending on the data obtained and the technique used, the attacker may be able to use it for fraudulent transactions or other financial theft, including ATM cash withdrawals.

The SpyNote RAT and variants such as SpyMax and CypherRAT have been circulating since at least 2021 and recorded an increase in detections in late 2022 and early 2023, following the leak of the malware’s source code.

The malware can steal bank data, Facebook and Google account credentials, Google Authenticator codes, GPS tracking, and SMS texts. It can also activate the device microphone and camera, and generic intercept keystrokes.

Group-IB has identified almost two dozen WindRelay samples submitted to VirusTotal between November 2025 and July 2026 that communicated with four command-and-control IP addresses.

According to the researchers, targeting appears focused on Czechia, Slovakia, and Slovenia, based on the organizations impersonated and the languages used.

Unless they know and trust the publisher, Android users are advised to avoid APK packages outside Google Play, and to be very careful with apps that request NFC access or other dangerous permissions.

When receiving a call from your bank and asked to take urgent action, it is advisable to terminate the call, dial the number listed on the organization's official website, and ask to connect with the same support agent.

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report