Medium cybersecurity update: Android malware combo takes out loans and relays victims' credit cards. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal live card data and send it to attackers in real time. […] Android malware combo takes out loans and relays victims' credit cards A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal card data and send it to attackers in real time. In an incident investigated by the cybersecurity company Group-IB, a fraudster impersonated a bank employee and called the victim under the pretense of a problem with their payment card. During the call, the threat actor instructed the victim to sideload the SpyNote RAT disguised as a legitimate app and grant it Accessibility Service permissions, giving the attacker remote access to the Android device. To add credibility, the attacker personalized the malicious app label with the victim's name. After gaining remote access to the device through SpyNote, the attacker installed WindRelay without further interaction with the victim and used the banking app to take out a loan in the victim’s name. Additionally, the victim was instructed to tap their payment card on the phone and enter their PIN. WindRelay turned the phone into a fraudulent contactless reader and relayed the live NFC (near-field communication) exchange, including the card’s transaction-specific authentication data, to the attacker’s device.
Technical Details
This allowed the attacker to use the card data for purchases at a genuine payment terminal. Group-IB says that the entire activity occurred in a 13-minute phone call, and transactions were approved using the PIN provided by the victim. The researchers highlight that the combination of SpyNote and WindRelay may indicate a toolkit that provides both access to the victim's device for banking transactions and a direct cash-out channel. Also, in contrast to most modern Android malware with live screen sharing and VNC features, this malware mix enabled the attackers to commit fraud solely through social engineering over the phone. Android NFC malware is a growing problem , as shown by malware families such as NFCShare , NGate , SuperCard X , and RelayNFC. In a typical attack, the victim installs a malicious app and grants it access to NFC. The attacker then uses social engineering to trick the victim into tapping their payment card against the compromised phone. The phone uses its NFC interface to communicate with a contactless payment card and capture available data, which it then transmits over the internet to an attacker-controlled device. Depending on the data obtained and the technique used, the attacker may be able to use it for fraudulent transactions or other financial theft, including ATM cash withdrawals.
Security Impact
Organizations using the affected technology should treat the report according to its medium severity classification. The SpyNote RAT and variants such as SpyMax and CypherRAT have been circulating since at least 2021 and recorded an increase in detections in late 2022 and early 2023, following the leak of the malware’s source code . The malware can steal bank data, Facebook and Google account credentials, Google Authenticator codes, GPS tracking, and SMS texts. It can also activate the device microphone and camera, and generic intercept keystrokes. Group-IB has identified almost two dozen WindRelay samples submitted to VirusTotal between November 2025 and July 2026 that communicated with four command-and-control IP addresses. According to the researchers, targeting appears focused on Czechia, Slovakia, and Slovenia, based on the organizations impersonated and the languages used. Unless they know and trust the publisher, Android users are advised to avoid APK packages outside Google Play, and to be very careful with apps that request NFC access or other dangerous permissions. When receiving a call from your bank and asked to take urgent action, it is advisable to terminate the call, dial the number listed on the organization's official website, and ask to connect with the same support agent.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Medium
- Original source: BleepingComputer
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from BleepingComputer for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
