A newly identified Android malware family, dubbed WindRelay, is being utilized alongside the SpyNote remote access trojan (RAT) to facilitate contactless payment fraud. This sophisticated scheme leverages near field communication (NFC) technology to intercept and relay victims’ card data in real-time, enabling unauthorized transactions.
WindRelay’s operation begins with social engineering tactics, such as phishing, smishing, or vishing, to trick users into sideloading a malicious application. Once installed, SpyNote exploits Android’s Accessibility Services to silently install the NFC relay component without the user’s knowledge. Notably, the malware’s APK file is often personalized with the victim’s name, suggesting prior reconnaissance to enhance the credibility of the attack.
Victims are then manipulated into tapping their physical payment cards against their compromised devices under false pretenses, such as verifying their identity or updating their PIN. This action transforms the victim’s smartphone into an unwitting proxy, capturing the card’s NFC signals and transmitting them to the attackers in real-time.
The WindRelay malware consists of two synchronized components:
- Reader Component: Installed on the victim’s device, it interfaces with the physical payment card via NFC.
- Emulator Component: Residing on the attacker’s device, it emulates the victim’s card at a payment terminal.
These components communicate through a shared command-and-control (C2) infrastructure over WebSocket, relaying EMV Application Protocol Data Unit (APDU) commands and responses between the payment terminal and the victim’s card in real-time.
Over the past year, NFC relay malware targeting Android devices has expanded beyond initial reports in the Czech Republic to countries like Brazil, Poland, and Slovakia. This method, often referred to as “Ghost Tap,” allows cybercriminals to remain anonymous while conducting large-scale fraudulent transactions. By capturing NFC data, attackers can replicate victims’ bank cards on their own devices, facilitating unauthorized cash withdrawals and payments.
Group-IB’s findings highlight a concerning evolution in Android malware, combining NFC relay techniques with RAT capabilities. This dual approach not only enables data extraction and persistent access but also opens multiple avenues for financial fraud. Between November 2025 and July 2026, 23 WindRelay samples were uploaded to VirusTotal, masquerading as financial institutions in Czechia, Slovakia, and Slovenia.
As mobile payment technologies become increasingly prevalent, the emergence of threats like WindRelay underscores the need for heightened vigilance. Users should exercise caution when installing applications, especially from unknown sources, and remain skeptical of unsolicited requests involving sensitive financial information. Financial institutions and cybersecurity professionals must collaborate to develop robust defenses against such sophisticated attack vectors.
