Group-IB researchers discovered WindRelay, a new Android malware built to capture live payment card data over NFC (Near Field Communication) and relay it to attackers in real time. WindRelay is paired with the SpyNote remote access trojan, which gives attackers remote access to a victim’s device.
Attack chain overview (Source: Group-IB)
How the scam unfolds
The scam starts with a phone call, in which the fraudster claims to be from the victim’s bank and says there is a problem with their card. Guided step by step, the victim installs an app themselves.
That app is SpyNote, and it carries a detail meant to lower the victim’s guard. The app’s label shows the victim’s own name instead of a strange or generic one. Group-IB researchers found that SpyNote’s builder toolkit lets an operator customize the app’s label, name, and package for each target before deployment.
Once SpyNote has remote access, the fraudster installs a second app (WindRelay) on the device without further action from the victim. WindRelay uses NFC to communicate with the payment card and an internet connection to relay that exchange as it happens. It also requests access to the victim’s contacts and a system-inspection permission unusual for a third-party app.
“In one 13-minute phone call, the victim installed a RAT onto their own device — everything after that was performed by the fraudster. By the end of the call, the fraudster had taken out a loan in the victim’s name through remote access to the victim’s mobile app, and was streaming their card data to a fake merchant terminal,” Group-IB explained.
“Every transaction was approved using the PIN the victim had entered themselves. The victim stayed on a live call with the fraudster for the entire incident,” they added.
Card transactions began showing up on the victim’s account not long after the call ended.
Scale and targeting
Group-IB traced 23 WindRelay samples uploaded to VirusTotal between November 2025 and July 2026, tied to campaigns targeting victims in Czechia, Slovakia, and Slovenia. Researchers also identified four command-and-control IP addresses associated with the NFC relay activity.
Several samples carried victim-specific names and interface text matching the language of the target country, showing how the apps were tailored for individual victims and locations.
“This case shows that modern fraud rarely relies on one technique. Here, the fraudster combined three capabilities in a single session — a live social engineering call, a personalized RAT for remote device control, and an NFC relay malware for physical cash-out,” Group-IB concluded.
