WindRelay Turns Android Phones Into Fake Payment Terminals for Remote Card Fraud

A newly identified Android malware family, tracked as WindRelay, is being used alongside the SpyNote remote-access trojan to convert victims’ phones into rogue contactless-card readers and enable real-time, card-present fraud.

Group-IB’s investigation centres on a 13-minute fraud call in which an attacker impersonating a bank employee convinced a victim to install a malicious Android app.

The first payload was a personalised SpyNote variant whose application label used the victim’s own name, a trust-abuse tactic designed to make a sideloaded APK appear familiar rather than suspicious.

SpyNote then abused Android Accessibility Service permissions to silently deploy a second application: WindRelay.

Unlike commodity banking malware that focuses on credential theft or overlay attacks, WindRelay is purpose-built for NFC relay operations. Once active, it turns the compromised phone into a counterfeit point-of-sale reader.

The victim is instructed to tap their physical payment card against the phone and enter a PIN, ostensibly to secure or verify the card.

In reality, the malware captures the live EMV contactless exchange and relays it through attacker-controlled infrastructure to a second Android device.

That remote device emulates the victim’s card at a real merchant terminal or ATM. The criminal does not need to clone static card details or possess the physical card: the relay forwards transaction messages between the genuine card and the legitimate terminal in real time.

Because the terminal receives valid, live cryptographic responses, the payment can appear to be an ordinary card-present transaction. This fraud model is commonly described as NFC relay fraud or “Ghost Tap.”

GroupIB Researchers said that, the operation illustrates how NFC relay malware, remote device control, and live vishing calls are converging into a high-speed cash-out model that can drain accounts before banks or victims recognise a compromise.

WindRelay Turns Android Phones

The scheme’s effectiveness lies in its layered design. The live call provides continuous social engineering and prevents the victim from independently assessing prompts or alerts.

SpyNote provides persistent remote control without necessarily invoking conventional screen-sharing workflows. WindRelay creates a separate card-fraud channel, allowing operators to monetise a card tap within seconds.

In the investigated case, the attackers also used their access to obtain a digital loan through the victim’s banking application, combining account takeover with physical-payment cash-out in a single session.

WindRelay’s permission set reflects that operational role. NFC enables communication with contactless cards, while internet and network-state access support immediate data relaying.

Access to contacts may support follow-on targeting, and the unusual DUMP permission may help operators inspect device state or identify defensive tooling.

Group-IB also observed custom application permissions intended to isolate internal components and complicate inspection by other applications.

The malware is not limited to a single victim or geography. Researchers linked WindRelay-related samples to campaigns targeting Czechia, Slovakia and Slovenia, identifying 23 samples submitted to VirusTotal between November 2025 and July 2026, as well as four command-and-control IP addresses used to relay NFC traffic.

The wider ecosystem has been expanding: separate research has documented NFC relay campaigns leveraging Android malware, malicious card-verification lures and attacker-operated relay servers to complete remote contactless transactions.

The case reinforces a critical defensive point for banks and fraud teams: absence of screen sharing does not indicate absence of remote control.

High-confidence signals include sideloaded applications installed during active calls, Accessibility Service abuse, personalised APK labels, rapid installation of multiple apps, and combinations of NFC, internet and suspicious device-inspection permissions.

For users, banks will not ask them to install an APK, enable Accessibility access, or tap a physical card against a phone during an unsolicited support call.

A bank claiming otherwise should be independently contacted through an official number. For defenders, WindRelay demonstrates that NFC fraud detection must extend beyond transaction scoring to include mobile-device telemetry, app provenance, session behaviour and real-time call context.

IOCs

IOC	Type
88[.]86[.]124[.]114	C2 IP
185[.]100[.]87[.]116	C2 IP
185[.]100[.]87[.]223	C2 IP
213[.]218[.]160[.]48	C2 IP
852322e063872a025b711d5adf08531eac36a265	SHA1
11f9fb29f2cc142e81c804f53599ae36282c95b3	SHA1
50cf07b97ef999e9fc5c7efae19d0e5f39db39fa	SHA1
850680506df7892d43b3382f0f89a06ef18837c7	SHA1
1371b2b2da10ed178d26a7aad191634553f865ae	SHA1

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now