Overview
- Group-IB published a technical report Wednesday that links a newly identified NFC relay family called WindRelay to a SpyNote variant and describes the full fraud unfolding in a single 13‑minute phone call.
- Attackers used a voice‑phishing call to persuade the victim to sideload a SpyNote APK personalized with the victim’s name and grant Accessibility permissions, giving remote control of the device.
- With the RAT active the attacker remotely installed WindRelay, instructed the victim to tap their payment card and enter a PIN, and streamed the live NFC exchange to a device that completed purchases at a real terminal and enabled a bank loan.
- Researchers say WindRelay captures the transaction‑specific authentication code and transmits it over the internet, and they flagged indicators such as sideloaded APKs, requests for NFC and Accessibility, unusual DUMP permission use, and communication with identified C2 IPs.
- Group‑IB and coverage note wider context: SpyNote has a builder tool and has been circulating since 2021, Android NFC relay fraud is rising, and banks should add signals to detect concurrent card‑present transactions and sudden loan disbursements to protect victims.