Reported by 4 outlets

Timeline

1. original reporting

   WindRelay Android Malware Relays Bank Cards While SpyNote RAT Controls Victim Phones

   cyberpress.org · 62d ago · August 12th, 2026

   A new Android malware family called WindRelay is being used with the SpyNote remote access trojan (RAT) to steal money through live NFC card-relay fraud. The operation combines phone-based social engineering, remote device control, and contactless payment abuse in one fast-moving attack. The campaign shows how fraudsters no longer need a victim’s physical card. Instead, they convince targets to tap their bank card against an infected Android phone. WindRelay then captures and relays the live NFC exchange to an attacker-controlled device, allowing fraudulent in-store payments or ATM withdrawals . NFC relay fraud is growing quickly. Kaspersky reported that NFC-based Android attacks rose 188% in the first four months of 2026 compared with the same period in 2025. The technique works by placing malicious devices between a real payment card and a legitimate terminal, relaying the transaction data in real time.me-en. WindRelay and SpyNote Attack In the observed case, the fraud began with a phone call from an attacker posing as a bank employee. The caller claimed there was a problem with the victim’s payment card and instructed them to install an Android application. That first app was a personalized SpyNote RAT . Rather than using a generic label, the malware reportedly displayed the victim’s own name. This detail can make a malicious application appear more trustworthy and suggests that the operators had basic personal information before calling. Active call early detection (befor

2. update from gbhackers.com

   WindRelay Turns Android Phones Into Fake Payment Terminals for Remote Card Fraud

   gbhackers.com · 62d ago · August 12th, 2026

   A newly identified Android malware family, tracked as WindRelay, is being used alongside the SpyNote remote-access trojan to convert victims’ phones into rogue contactless-card readers and enable real-time, card-present fraud. Group-IB’s investigation centres on a 13-minute fraud call in which an attacker impersonating a bank employee convinced a victim to install a malicious Android app. […] The post WindRelay Turns Android Phones Into Fake Payment Terminals for Remote Card Fraud appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from bleepingcomputer.com

   Android malware combo takes out loans and relays victims' credit cards

   bleepingcomputer.com · 62d ago · August 12th, 2026

   In an incident investigated by the cybersecurity company Group-IB, a fraudster impersonated a bank employee and called the victim under the pretense of a problem with their payment card. During the call, the threat actor instructed the victim to sideload the SpyNote RAT disguised as a legitimate app and grant it Accessibility Service permissions, giving the attacker remote access to the Android device. Builder creates victim-specific SpyNote APKs Source: Group-IB After gaining remote access to the device through SpyNote, the attacker installed WindRelay without further interaction with the victim and used the banking app to take out a loan in the victim’s name. WindRelay turned the phone into a fraudulent contactless reader and relayed the live NFC (near-field communication) exchange, including the card’s transaction-specific authentication data, to the attacker’s device. This allowed the attacker to use the card data for purchases at a genuine payment terminal. Group-IB says that the entire activity occurred in a 13-minute phone call, and transactions were approved using the PIN provided by the victim. Attac

4. update from malware.news

   Android malware lets criminals use your bank card in real time

   malware.news · 61d ago · August 13th, 2026

   Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it “WindRelay.” NFC (Near Field Communication) is wireless technology that allows devices such as smartphones, payment cards, and payment terminals to communicate when they’re very close together. SpyNote gave the attacker remote control of the phone and enabled the quiet installation of a second app, WindRelay .