Malware

WindRelay

WindRelay is an Android NFC relay malware family used for contactless-payment fraud. It captures the live NFC exchange between a victim’s physical payment card and an infected Android device, then relays EMV commands and responses in real time to an attacker-controlled device that can present the card interaction to a merchant terminal or contactless ATM. This real-time relay permits fraudulent card-present transactions using transaction-specific payment data rather than reusable static card details.

WindRelay has been deployed with the SpyNote remote-access trojan in telephone-based bank-impersonation scams. Victims are persuaded during a live call to sideload a personalized SpyNote application and grant Accessibility permissions. Operators then use SpyNote’s device-control capability to silently install and activate WindRelay. Victims are instructed to tap their payment card to the phone and enter its PIN, while the attackers relay the contactless transaction to conduct fraudulent purchases or withdrawals. The same remote access has also been used to access mobile banking applications and carry out lending fraud.

WindRelay activity has been associated with campaigns impersonating financial institutions and targeting Android users in Czechia, Slovakia, and Slovenia. The malware exemplifies the Ghost Tap category of NFC relay fraud, combining social engineering, remote device takeover, and a direct card-present cash-out mechanism.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598.004Spearphishing VoiceEvidence5

These attacks typically work by luring prospective targets via phishing, smishing, or vishing scams into sideloading a malicious app.

Initial Access

3 techniques

T1566PhishingEvidence3

“The fraudster called the victim posing as a bank employee, claiming a problem with their bank card.”

T1566.003Spearphishing via ServiceEvidence1

These attacks typically work by luring prospective targets via phishing, smishing, or vishing scams into sideloading a malicious app.

T1566.004Spearphishing VoiceEvidence3

"Attackers use live social engineering calls to convince victims to install a personalized RAT"

Execution

2 techniques

T1204User ExecutionEvidence1

These attacks typically work by luring prospective targets via phishing, smishing, or vishing scams into sideloading a malicious app.

T1204.002Malicious FileEvidence2

“The victim installed the first app — a RAT, labeled with the victim’s own name — after being guided to do so by the fraudster on the call.”

Persistence

1 technique

T1546.008Accessibility FeaturesEvidence2

It is deployed alongside the SpyNote RAT, whose Accessibility Service access allows attackers to silently install and activate the NFC malware through live-call social engineering.

Privilege Escalation

1 technique

T1546.008Accessibility FeaturesEvidence2

It is deployed alongside the SpyNote RAT, whose Accessibility Service access allows attackers to silently install and activate the NFC malware through live-call social engineering.

Stealth

1 technique

T1036MasqueradingEvidence1

This sample’s app label was personalized with the victim’s own name, not a generic or impersonated brand.

Credential Access

2 techniques

T1557Adversary-in-the-MiddleEvidence1

The attack, which the researchers named "Zombie Card," requires physical possession of the expired card or sustained NFC proximity to it, plus a man-in-the-middle (MitM) relay positioned between the card and the terminal.

T1649Steal or Forge Authentication CertificatesEvidence2

What’s stolen: Not a static card number, but the live data exchange between the card’s chip and a reader at the moment of the tap — including the one-time authentication code the card generates for that specific transaction.

Collection

2 techniques

T1005Data from Local SystemEvidence2

WindRelay, a new Android malware built to capture live payment card data over NFC (Near Field Communication) and relay it to attackers in real time.

T1557Adversary-in-the-MiddleEvidence1

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence6

In a report published August 12, 2026, the firm said it identified 23 samples uploaded to VirusTotal between November 2025 and July 2026 and four command-and-control (C2) IP addresses.

T1090ProxyEvidence5

They dubbed it “WindRelay.” ... capture live card data via NFC and forward it in real time to attackers... That tap let the second app forward the card’s contactless data in real time to the criminals

T1105Ingress Tool TransferEvidence8

"[Attackers] remotely deploy WindRelay without additional user interaction."

T1219Remote Access ToolsEvidence1

"WindRelay, a new Android NFC relay malware deployed alongside the SpyNote remote access trojan" and "remote access can facilitate additional financial fraud."

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The captured exchange is streamed out over the internet, in real time, to a second device in the fraudster’s hands — not stored and reused later, but relayed as it happens.

Other

1 technique

T1656ImpersonationEvidence2

“The attackers call the victims, impersonating bank employees and instruct them to install a malicious app.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

55 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

51 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app1 month ago

ACTIVITY FEED

Recent activity

13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

13 SOURCESView more in app

zimperium blogNews

Aug 27, 2026

WindRelay Combines NFC Relay Malware and Remote Access for Mobile Fraud

Android NFC relay malware remotely deployed after device takeover. It captures and relays victims' live NFC payment-card data to attacker-controlled devices, enabling unauthorized purchases or cash withdrawals.

knowbe4 blogNews

Aug 26, 2026

Attackers Use Vishing Attacks to Distribute New Android Malware

Android NFC-relay malware installed after fraudsters obtain remote access to a victim device. It relays card data to a fraudulent merchant terminal so transactions can be approved with the victim-entered PIN.

cyber security newsNews

Aug 20, 2026

New Android Malware Manic Steals Banking PINs and Relays Data Through Peer Devices

Referenced as a similar 2026 Android malware discovery; described only as NFC relay malware.

gurucul threat researchNews

Aug 20, 2026

Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme | Community Portal | Gurucul

Newly identified Android NFC relay malware that captures and remotely relays contactless payment card data to facilitate fraudulent transactions.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching55

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

WindRelay