WindRelay and SpyNote combine in Android NFC payment fraud
Group-IB has identified a previously unseen Android near field communication relay malware family, WindRelay, being used alongside the SpyNote remote access trojan in contactless payment fraud. First detected in the wild in late August 2025, WindRelay captures live payment-card data through NFC and transmits it to fraudsters in real time.
Group-IB recorded 23 WindRelay samples uploaded to VirusTotal between November 2025 and July 2026. The samples impersonated financial institutions in Czechia, Slovakia and Slovenia, as NFC relay malware activity expanded beyond the Czech Republic to Brazil, Poland and Slovakia during the past year.
A two-part relay for card-present fraud
WindRelay comprises a reader component on the victim’s Android phone and an emulator component on the attacker’s device. The reader communicates with a physical payment card through NFC, while the emulator presents the card to a payment terminal.
The two components communicate through shared command-and-control infrastructure over WebSocket. They relay EMV APDU commands and responses in real time between the terminal and the victim’s card, effectively making the infected phone a payment proxy without the cardholder’s awareness.
This technique is also known as Ghost Tap. It can enable a criminal to mimic a bank card on a separate device for payments or cash withdrawals while keeping physical distance from the victim and the original card.
SpyNote enables the silent installation step
The operation begins with phishing, smishing or vishing designed to persuade a target to sideload a malicious application. Group-IB said the APK delivered during a phone call can be personalised with the victim’s name, suggesting attackers obtain names and telephone numbers before contact to strengthen their pretext.
After SpyNote is installed, its Accessibility Service permissions allow the operator to sideload and activate the NFC application without further user interaction and without triggering screen sharing. The caller then persuades the victim to tap a physical payment card against the infected handset, often claiming that the action is needed for identity verification, a PIN change or a response to an alleged account compromise.
The pattern adds a payment-fraud route to the remote-access risks seen in SIM farms and social-engineering infrastructure, where SIM farms and social-engineering infrastructure illustrated how criminal operations combine services and techniques. In this case, the same session can pair a live call, personalised remote device control and NFC relay capability.
Two potential payout channels
Group-IB described the operation as a dual monetisation strategy. RAT-driven access can be used to seek a digital loan, while the NFC component can support physical card-present purchases before a bank or customer has time to react.
For businesses, the practical implication is to treat unsolicited calls requesting card taps or application installation as high-risk fraud signals. Security teams should restrict sideloading where managed Android devices are used, review Accessibility Service permissions, and ensure staff have a clear route to verify bank-related requests through trusted channels.