WindRelay Malware Uses SpyNote to Relay Android Payment Card Data

Summary

Group-IB reports that attackers combined SpyNote RAT and WindRelay in an Android fraud campaign, using social engineering and live NFC relaying to make fraudulent transactions. The activity reportedly took 13 minutes and targeted users in three European countries.

Key points

Attackers impersonated bank staff and persuaded a victim to sideload SpyNote disguised as a legitimate app and grant Accessibility Service permissions.
SpyNote provided remote device access, enabling the attacker to install WindRelay without further victim interaction.
WindRelay relayed live NFC card data, including transaction-specific authentication data, after the victim tapped a card on the phone and entered a PIN.
Group-IB says the attacker used the victim’s banking app to take out a loan and made purchases at a genuine payment terminal using the relayed card data.
The investigated activity reportedly took place during a 13-minute phone call; Group-IB says targeting appears focused on Czechia, Slovakia, and Slovenia.
Group-IB identified almost two dozen WindRelay samples submitted to VirusTotal between November 2025 and July 2026, communicating with four command-and-control IP addresses.
The article advises avoiding APKs from untrusted sources and independently calling a bank’s official number when asked to take urgent action.

Article Details

Event Type: Android malware-enabled NFC relay and banking fraud campaign.
Impact: In an incident investigated by Group-IB, attackers allegedly impersonated bank staff and used SpyNote to gain remote access to a victim’s Android device, then installed WindRelay. The victim was induced to take out a loan and tap a payment card on the phone; WindRelay relayed live NFC data, including transaction-specific authentication data, enabling purchases at a genuine payment terminal using the victim-provided PIN. Group-IB said targeting appeared focused on Czechia, Slovakia, and Slovenia.