Loading story…
A newly identified Android fraud campaign is using the SpyNote remote-access trojan alongside a previously unseen NFC relay malware family called WindRelay to steal funds from bank customers in minutes. Group-IB said attackers impersonated bank employees in live phone calls, persuaded victims in Czechia, Slovakia, and Slovenia to sideload a malicious app, and abused Android Accessibility features to take control of the device and the victim’s banking app. In one investigated case, the criminals issued a loan in the victim’s name and began fraudulent activity within 13 minutes.
After gaining access, the attackers remotely installed WindRelay and instructed the victim to tap their physical payment card against the phone. The malware captured live NFC card data and a one-time transaction code, then relayed the exchange in real time to a second attacker-controlled device used at a legitimate payment terminal, enabling fraudulent card-present purchases without relying on stolen static card details. Group-IB linked the activity to 23 VirusTotal samples uploaded between November 2025 and July 2026 and said the operation shows how social engineering, sideloaded apps, and live NFC relaying can accelerate account takeover and payment fraud while evading ordinary checks.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Group-IB linked WindRelay to 23 malware samples uploaded to VirusTotal between November 2025 and July 2026. The samples impersonated institutions in Czechia, Slovakia, and Slovenia.
Group-IB said it first detected the previously unseen Android NFC relay malware family WindRelay in late August 2025. The malware was observed being used alongside SpyNote in contactless payment fraud schemes.
Group-IB said Czech Police arrested a 22-year-old suspect in Prague after reports of ATM withdrawals carried out without a physical card. The arrest was described as part of earlier NFC relay fraud activity in the Czech Republic.
Kaspersky says the first documented attacks using a criminally modified version of the NFCGate NFC research tool occurred in the Czech Republic in late 2023. The attacks marked an early real-world use of NFC relay malware for financial theft.
During its investigation, Group-IB identified the pairing of SpyNote RAT with the newly tracked WindRelay NFC relay malware and reported campaigns targeting users in Czechia, Slovakia, and Slovenia. The reporting also disclosed indicators including WindRelay command-and-control IPs and malware sample hashes.
After physical card charges appeared on the victim's account, the bank confirmed that NFC relay activity had occurred. This validated that the attackers had used relayed live chip-card communication rather than stolen static card details.
In a documented case, a caller posing as a bank employee convinced a victim to sideload a SpyNote-based Android app, then remotely installed WindRelay, used the victim's banking app to obtain a loan, and relayed live NFC card data for fraudulent card-present purchases. Group-IB said the loan fraud and card abuse were completed within 13 minutes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
12 references tracked. Mallory keeps watching after this page renders.
zimperium.com
Open sourceblog.knowbe4.com
Open sourcecommunity.gurucul.com
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcegroup-ib.com
Open sourcekaspersky.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified a surge in Android malware that abuses Near Field Communication (NFC) and Host Card Emulation (HCE) features to steal payment data and conduct fraudulent transactions. Since April 2024, over 760 malicious apps have been detected, with campaigns expanding from isolated incidents to a global threat affecting users in Russia, Poland, the Czech Republic, Slovakia, Brazil, and other countries. These apps impersonate trusted financial institutions and government services, including the Central Bank of Russia, Gosuslugi, Santander, and VTB Bank, to deceive users into installing them and setting them as the default payment method. Once installed, the malware activates NFC relay functionality, capturing card data in real time and forwarding it to attacker-controlled servers. The operation is coordinated through more than 70 command-and-control servers and numerous Telegram bots, enabling attackers to use one infected device to collect payment data and another to complete fraudulent transactions at physical terminals. The rapid proliferation and sophistication of these attacks highlight the growing risk to mobile payment systems and the need for increased vigilance among Android users and financial institutions.
Jul 12, 2026
New variants of **NFCShare** are targeting mobile banking customers across Europe through phishing sites and GitHub-hosted fake banking app updates that impersonate legitimate banks. Researchers said the campaign, first seen spoofing Deutsche Bank, has expanded to primarily target banking brands in **Italy and Spain**, with victims lured into installing malicious APKs after being told to enable apps from unknown sources or follow fake bank update prompts. Once installed, the malware abuses a phone’s **NFC** capability to trick victims into scanning their payment cards and entering their PINs, then exfiltrates the stolen card data and PINs to attacker-controlled infrastructure over **WebSocket** for potential NFC payment relay fraud. Investigators also reported that newer samples are rebuilt rapidly and use malformed APK packaging, including broken ZIP paths, to disrupt automated analysis and slow detection while preserving recognizable behaviors such as combined **WebView** and NFC activity.
Jul 12, 2026
SpyNote, also tracked as **SpyMax** and commercialized in some cases as **CypherRat**, has evolved from Android surveillance malware into a broad financial-theft platform targeting banking and cryptocurrency users through fake apps and social-engineering lures. Researchers linked a major rise in infections to the public leak of CypherRat source code, which enabled multiple actors to rapidly build custom variants impersonating banks, Google Play, WhatsApp, Facebook, and other trusted brands. Across campaigns, the malware abuses Android **Accessibility Services** to automate installation and updates, resist removal, keylog victims, intercept SMS messages and calls, steal banking credentials, capture Google Authenticator codes, and monitor audio, video, screen activity, and location. Later samples showed SpyNote operators refining both monetization and evasion. Fortinet reported a crypto-wallet-themed variant that overlaid legitimate wallet apps, replaced destination addresses with attacker-controlled ones, and automated fund transfers, while another sample disguised as an OnlyFans app used a dropper to install a second APK and bypass Android 13 **Restricted Settings** through a session-based `PackageInstaller` flow. Regional campaigns in India used fake **IRCTC** and “Wedding Invitation” APKs spread via WhatsApp to steal OTPs, clipboard data, notifications, contacts, and banking information, with researchers also noting malformed APK structures, packing, anti-emulation checks, and compressed command-and-control traffic designed to frustrate reverse engineering and prolong infections.
Aug 15, 2026