A Duo of Android Malware Takes Out Loans and Relays Victims' Cards in Real Time

Group-IB has described an incident in which two malicious Android programs worked in tandem, turning a single phone call into a full-blown robbery. The newcomer is called WindRelay — an NFC relay that, paired with the well-known remote access trojan SpyNote, intercepts bank card data and passes it to the attacker in real time.

A 13-Minute Scheme

It all starts with a call: the fraudster poses as a bank employee and reports some sort of problem with the victim's payment card. Under this pretext, the victim is persuaded to install an app outside of the Google Play store — in reality a disguised SpyNote — and to grant it Accessibility Service permissions. For added credibility, the attackers personalize the app's icon, inserting the victim's own name into its title.

Having gained remote access, the attacker then installs WindRelay without any human involvement and, through the banking app, takes out a loan in the phone owner's name. In parallel, the victim is asked to hold their card against the smartphone and enter their PIN. At that moment WindRelay turns the phone into a fake contactless terminal: it relays the live NFC exchange, including the one-time transaction authentication data, to the criminal's device. From there the card can be used to pay at a real payment terminal.

According to Group-IB, the entire operation fit within a single phone conversation lasting 13 minutes, and the transactions were confirmed with the very PIN that the victim had spoken aloud.

Fraud Without a View of the Screen

The researchers point out a curious detail: unlike most modern Android malware with screen-streaming and VNC capabilities, here pure social engineering over the phone was enough to succeed. The SpyNote–WindRelay combination looks like a ready-made kit, providing both access to the device for banking operations and a direct channel for cashing out.

NFC threats for Android are gradually multiplying — before WindRelay, the NFCShare, NGate, SuperCard X, and RelayNFC families had already been spotted. SpyNote itself, along with the SpyMax and CypherRAT variants, has been circulating online since at least 2021, and after its source code leaked, the number of detections rose noticeably. Beyond banking data, it can steal Facebook and Google accounts, Google Authenticator codes, SMS messages, and GPS coordinates, as well as switch on the microphone and camera.

Group-IB found around two dozen WindRelay samples on VirusTotal, uploaded between November 2025 and July 2026 and communicating with four command-and-control servers. Judging by the impersonated organizations and languages, the attacks are aimed at the Czech Republic, Slovakia, and Slovenia.

The experts' advice is simple: don't install APKs from unverified sources, and treat apps that request NFC access with caution. And if you get an unexpected call from a “bank” demanding urgent action, it's best to hang up and call back using the number on the organization's official website.

Source: Bleeping Computer