Executive Summary
On August 14, 2026, cybersecurity firm Group-IB published a groundbreaking investigation into a highly sophisticated cybercrime operation deploying "WindRelay"—a novel Android malware designed to capture and relay contactless payment card data over Near Field Communication (NFC) in real time. This operation represents a significant leap in mobile financial fraud, combining live social engineering (vishing) with multi-stage malware deployment. By pairing a personalized SpyNote Remote Access Trojan (RAT), which is dynamically tailored with the victim's name, with the secondary WindRelay payload, threat actors can execute instantaneous bank loans and physical card cash-outs at Point-of-Sale (POS) terminals and ATMs. The entire lifecycle—from the initial call to the final fraudulent transaction—is often completed within a single, high-pressure 13-minute session.
Deep-Dive Technical Analysis
1. The Multi-Stage Attack Chain: From Vishing to RAT Deployment
The operational lifecycle of this campaign is defined by its speed and psychological precision:
* Stage 1 (Personalized Vishing Call): The attack begins with a "vishing" (voice phishing) call where fraudsters pose as legitimate bank security representatives. They allege that fraudulent activity has been detected on the victim's card and claim an urgent security update is required. Under this guise, the victim is guided to download and install a malicious APK file.
* Stage 2 (Customized SpyNote RAT): The primary payload is a heavily modified version of the SpyNote RAT. Utilizing a builder toolkit, operators dynamically customize the application's package name and label to display the victim’s actual full name rather than a generic or suspicious title. This personalization significantly lowers the victim's suspicion during installation. Once active, SpyNote requests access to Android Accessibility Services. When granted, this provides the operators with complete remote control over the device, including screen touch injection, keystroke logging, and comprehensive app management.
2. The Mechanics of Real-Time NFC Card Relaying (WindRelay)
The technical core of the campaign lies in the transition from remote device control to physical financial theft through WindRelay:
* Silent Secondary Installation: Once the SpyNote RAT establishes a stable reverse shell, the attackers silently install the WindRelay payload in the background. This occurs without any further user interaction or visual notification.
* The Card-Tapping Lure: While maintaining the live phone call, the attacker instructs the victim to hold their physical contactless debit or credit card against the back of their Android phone. The pretext given is to "verify the security chip" or "calibrate the new security software."
* APDU Frame Capture and WebSocket Streaming: As the card is held against the phone, WindRelay engages Android’s Host-based Card Emulation (HCE) and NFC adapter APIs. It reads the raw Application Protocol Data Units (APDUs) directly from the EMV payment chip. Instead of storing this data, the malware immediately transmits these cryptographic challenge-response frames over a persistent, low-latency WebSocket or TCP connection to a command-and-control (C2) server.
* Physical Point-of-Sale Terminal Cash-Out: A physical co-conspirator, located at a different geographical site, stands before an ATM or merchant POS terminal with a "relay-receiver" Android phone. This device simulates the victim's physical card by replaying the APDU frames received from the C2 server. When the POS terminal prompts for a PIN, the victim, still on the phone with the "bank representative," is prompted to enter it on their device or verbally confirm it, allowing the fraudulent transaction to be authorized seamlessly in real time.
3. Campaign Scope, Infrastructure, and Telemetry
Group-IB Threat Intelligence identified 23 distinct WindRelay samples on VirusTotal between late 2025 and July/August 2026. The telemetry indicates a focused targeting strategy directed at banking customers across Central and Eastern Europe, specifically in Czechia, Slovakia, and Slovenia. The malware features localized user interfaces and utilizes a dedicated C2 infrastructure designed for the high-speed data transfer required for real-time EMV relaying.
Industry Impact on Mobile Banking and Payment Security
As detailed in the Help Net Security Analysis, the emergence of NFC relay malware represents a fundamental paradigm shift in the financial cybercrime landscape:
* Bypassing 2FA and Biometrics: Traditional digital fraud detection often focuses on Card-Not-Present (CNP) transactions. However, because WindRelay facilitates a real-time communication bridge with the physical EMV chip, the transaction appears to the banking backend as a legitimate, physical "Card-Present" event. This effectively bypasses many 2FA and biometric security layers designed for digital transfers.
* Device Convergence: This campaign demonstrates how mobile phones are being transformed from personal communication tools into active hardware bridges for unauthorized physical financial transactions, effectively turning a victim's own hardware against their physical assets.
Defensive Strategies and User Protection Guidelines
To mitigate the risks posed by hybrid RAT and NFC relay campaigns, the following measures are recommended:
1. User Education & Verification: It is critical to reinforce that legitimate financial institutions will never contact customers via phone to request the installation of remote-access software or ask them to tap their physical payment cards against their mobile devices for verification.
2. System-Level Protections: Users should be encouraged to disable NFC functionality on their Android smartphones when not actively performing a purchase to close the hardware vector for relay attacks.
3. Mobile Threat Defense (MTD): Organizations should deploy endpoint protection capable of monitoring and detecting the unauthorized use of Accessibility Services and identifying background processes that hook into NFC listening APIs.
4. Banking App Hardening: Developers should implement anti-tampering and Runtime Application Self-Protection (RASP) solutions. These tools can detect active screen mirroring, the presence of known RATs, and unusual NFC polling activity during active banking sessions, providing an automated layer of defense against real-time relay attempts.