A fraudster calling in the name of your bank no longer needs your card number or a one time passcode. They need you to tap your card against your own phone. Researchers at Group-IB have documented a new Android malware family, tracked as WindRelay, that turns a victim's handset into a fake payment terminal and streams the card's live data to a second device in the criminal's hands, where it is used to buy goods or pull cash from an ATM.
WindRelay does not work alone. In the case Group-IB's Fraud Protection team investigated, it was paired with SpyNote, a well known remote access trojan, and the entire compromise ran inside a single 13 minute phone call. The original report describes a caller posing as a bank employee reporting a problem with the victim's card, then talking them through installing the first app themselves.
Why the victim did not hesitate
That first app was SpyNote, and its app label carried the victim's own name rather than a bank brand or a generic title. SpyNote ships with a builder toolkit that lets an operator set a custom label and package name for each build, so the personalization was a menu option rather than bespoke effort. Group-IB reads it as evidence of pre-call reconnaissance, with the crew already holding the target's name and phone number and using them to remove the one cue people are trained to check before installing something unfamiliar.
With SpyNote's Accessibility Service access in place, the fraudster pushed WindRelay onto the device silently, without the victim approving anything and without ever triggering a screen sharing prompt. Group-IB stresses that point for defenders: no screen share does not mean no remote access.
How the card tap is stolen
What WindRelay captures is not a static card number. It is the live exchange between the card's chip and a reader, including the one time authentication code the card generates for that specific transaction. The malware makes the phone behave exactly like a contactless point of sale terminal, and the INTERNET permission relays that exchange in real time to a device the fraudster is holding at a genuine terminal or ATM. The card and the merchant terminal are in effect still talking to each other with an invisible hop in between, so the payment authorizes normally. In this case the victim entered their own PIN, as instructed on the call, and the operator used the same remote access to take out a loan in the victim's name. Group-IB assesses that loan was likely an opportunistic add on rather than a planned step.
The permission set looks engineered: NFC for capture, INTERNET and ACCESS_NETWORK_STATE for live exfiltration, READ_CONTACTS to reach further targets, and DUMP, an unusual request for a third party app that would allow deeper inspection of device state. Custom self declared permissions wall the app's components off from other software on the phone, making it harder for security tooling to interfere.
How far it has spread
Group-IB correlated sample metadata to campaigns against victims in Czechia, Slovakia and Slovenia, identifying 23 samples uploaded to VirusTotal between November 2025 and July 2026. The samples mimic local institutions and carry text in each target country's language, some with personalized labels like the RAT. Four command and control IPs were identified. The wider trend is steep: Kaspersky telemetry cited in the report has NFC based attacks on Android devices rising 188% in the first four months of 2026 against the same period a year earlier, while Zimperium has tracked NFC relay campaigns across Poland, Czechia and Slovakia supported by more than 70 command and control servers and distribution hubs.
What defenders should do
Group-IB's guidance leans on timing rather than hashes. Alert on app installs through the package installer that happen during an active call, a pattern the team calls a strong signal on its own. Build detection around permission sets instead of known sample hashes, and add checks for remote access indicators that do not require screen sharing, such as Accessibility Service abuse or device admin grants shortly after a call begins. Banks are advised to apply step up authentication or a cooling off period to loan applications raised while other risk signals are live, and to correlate a loan disbursement with a card present transaction for the same customer, a combination the report notes is unusual in genuine activity. For customers, the memorable red flag is the one this crew invented: an app whose name is your own name.
The live operator pattern echoes fraud we have covered before, including a hands on toolkit used against Mexican bank customers and dropper apps smuggling banking trojans onto Google Play. Wider country context sits on our Czech Republic profile.
Indicators of compromise
WindRelay command and control, defanged: 88[.]86[.]124[.]114, 185[.]100[.]87[.]116, 185[.]100[.]87[.]223 and 213[.]218[.]160[.]48. Sample SHA1 hashes include 852322e063872a025b711d5adf08531eac36a265 and 11f9fb29f2cc142e81c804f53599ae36282c95b3 for WindRelay, and e05575afe5a01d150daa8b4bb935213cc0e538f6 for the SpyNote build. Group-IB's report carries the full list, with research support credited to Pavel Naumov.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.