WindRelay Android Malware Relays Live NFC Payment Card Data via Vishing Scam

The convergence of advanced social engineering and specialized mobile exploit kits has reached a perilous milestone with the discovery of the WindRelay Android Malware. Uncovered in research published by cybersecurity intelligence firm Group-IB, this emergent threat campaign orchestrates a synchronized, multi-stage attack that transforms an unsuspecting victim’s smartphone into an active Near Field Communication (NFC) relay bridge. By chaining tailored voice phishing (vishing) schemes with an established Remote Access Trojan (RAT) and custom NFC-sniffing payloads, threat actors are capable of draining bank accounts, applying for unauthorized instant loans, and conducting contactless point-of-sale (POS) and ATM transactions within a single live telephone session.

Unlike traditional mobile banking trojans that rely primarily on credential harvesting, overlay attacks, or automated SMS one-time password (OTP) theft, the WindRelay Android Malware operates on a hybrid model that breaches both digital authentication boundaries and physical payment card security. The attack operates in real time, capitalizing on the EMV contactless communication protocols embedded in modern payment cards.

Anatomy of the 13-Minute Vishing and RAT Deployment Chain

The operational lifecycle of this attack is distinguished by its speed and psychological precision, often taking as little as 13 minutes to execute from initial phone contact to illicit fund exfiltration. Threat actors initiate contact through highly targeted vishing calls. Posing as security representatives or anti-fraud specialists from the victim’s financial institution, the fraudsters fabricate an urgent crisis—such as a flagged fraudulent purchase or an active compromise of the user’s account.

To establish credibility and ease suspicion, the attacker provides precise victim reconnaissance data gathered prior to the call. Once trust or panic is established, the caller convinces the victim to download and install a designated “security verification” or “protection” tool directly via an external APK download link.

1. Targeted Reconnaissance and Vishing: Fraudsters contact the victim, masquerading as bank fraud analysts, claiming immediate action is required to secure funds.
2. Personalized SpyNote RAT Staging: The victim is guided to download an Android package configured via the builder module of the prolific SpyNote RAT. The attackers customize the application package name and manifest labels to feature the victim’s actual legal name, creating an illusion of official personalization.
3. Privilege Escalation via Accessibility Services: Upon installation, the customized SpyNote payload prompts the user to grant critical Android Accessibility Services permissions. Once enabled, the RAT automates background interactions, suppresses operating system security dialogs, bypasses notification banners, and grants itself persistent device administrative privileges without displaying native screen-sharing indicators.
4. Covert WindRelay Delivery: Operating with unrestricted administrative control, the threat actor silently downloads, unzips, and installs the secondary specialized component—the WindRelay Android Malware—completely in the background.

Technical Mechanics of the WindRelay Android Malware

At the technical core of the campaign lies WindRelay, a lightweight yet purpose-built Android binary focused exclusively on hardware-level NFC interaction and real-time network tunneling. While SpyNote manages remote device control, SMS interception, and banking app manipulation, WindRelay acts as a hardware bridge between the handset’s NFC controller and the threat actor’s infrastructure.

Android devices interact with physical NFC cards through reader-mode APIs within the Android Open Source Project (AOSP) framework. WindRelay hooks into these subsystem calls, requesting low-level permissions to communicate directly with external smart cards via ISO/IEC 14443 Type A/B protocols. When initialized, the malware monitors the device’s NFC adapter for tag discovery events.

During the ongoing vishing call, the fraudster instructs the victim to physically hold or tap their contactless credit or debit card against the back of the smartphone under the pretense of “digitally verifying the chip” or “canceling the fraudulent charge”. The moment the physical EMV card enters the electromagnetic field generated by the handset’s NFC coil, WindRelay activates.

• APDU Capture: The malware captures the Application Protocol Data Unit (APDU) commands exchanged during the initial EMV handshake between the card chip and the mobile reader.
• Encrypted Transport Tunnel: Rather than saving or locally parsing card artifacts, WindRelay immediately encapsulates raw APDU frames into an encrypted TCP/WebSocket stream, routing the telemetry out through command-and-control (C2) servers.
• Low-Latency Relay Architecture: Because standard EMV payment transactions enforce strict hardware-level timeout thresholds (typically between 100 and 500 milliseconds per APDU command-response cycle), the malware’s transport layer is optimized for ultra-low latency to avoid transaction abort triggers at the merchant terminal.

Live Terminal Emulation: Bridging Physical Cards to Remote POS Terminals

The relay mechanism terminates at the attacker’s physical location, where a coordinated multi-device infrastructure operates in real time. The data captured by the WindRelay Android Malware on the victim’s phone is instantly routed to a secondary, attacker-controlled Android smartphone or dedicated hardware emulator running custom Host Card Emulation (HCE) software.

A second threat actor or physical cash-out “mule” stands in proximity to an automated teller machine (ATM) or an active Point-of-Sale (POS) terminal in another location. As the remote POS terminal issues terminal-to-card challenge APDUs (such as SELECT AID, GET PROCESSING OPTIONS, or GENERATE AC), the attacker’s emulator relays these commands backward through the C2 proxy to WindRelay on the victim’s phone. WindRelay presents the query directly to the real card held against the victim’s phone, collects the cryptographic response (Application Cryptogram), and pipes it forward to satisfy the terminal.

This live relay construct effectively fools the acquiring banking network and the point-of-sale terminal into validating the transaction as an authentic “card-present” contactless payment. Because genuine cryptographic material is generated dynamically by the victim’s authentic card chip on demand, standard dynamic CVV and replay protection mechanisms are entirely satisfied.

Dual Financial Exploitation: Instant Loan Fraud and Cash-Out

The severity of this threat actor playbook is compounded by a simultaneous dual-vector monetization model. While the physical relay is orchestrated over NFC, the attacker actively leverages the pre-installed SpyNote RAT to execute on-device banking fraud:

1. Remote Session Hijacking: The attacker uses SpyNote’s accessibility and screen interaction capabilities to launch the legitimate mobile banking application already authenticated on the victim’s device.
2. Pre-Approved Loan Origination: Threat actors navigate to the consumer credit section of the banking application and apply for pre-approved instant micro-loans or credit line extensions.
3. Balance Inflation and Instant Drain: The freshly disbursed loan capital is deposited directly into the victim’s primary checking balance. With the card still actively held against the handset, the physical mule uses the relayed contactless bridge at an ATM or merchant terminal to withdraw or spend the newly minted loan funds in rapid succession.

This synchronized assault leaves victims not only stripped of their existing liquid balances but heavily indebted under fraudulent loan contracts issued through their legitimate, device-authenticated banking credentials.

Geographic Footprint and Campaign Tracking

Telemetric analysis and VirusTotal sample indexing indicate that the WindRelay campaign has maintained an active footprint across Central and Eastern Europe, with high concentrations of activity identified in Czechia, Slovakia, and neighboring regional jurisdictions. Researchers identified dozens of distinct WindRelay and customized SpyNote loader binaries compiled with localization strings, domain names, and interface branding targeting regional commercial banks.

The modularity of the WindRelay architecture suggests that threat actors are continuously iterating on the framework, testing evasions against standard Google Play Protect definitions, and refining network packet serialization to maintain compatibility across varied EMV payment applets.

Mitigation Strategies and Enterprise Defenses

Defending against the WindRelay Android Malware requires a coordinated posture combining consumer awareness, endpoint protection, and behavioral risk scoring at the financial institution layer.

• NFC Lifecycle Management: Users should adopt the operational security habit of disabling the device’s NFC antenna via the Android Quick Settings panel when not actively engaged in a self-initiated payment.
• Strict Sideloading Hygiene: Android device owners must reject unsolicited requests to install software via APK links sent through SMS, messaging apps, or directed during telephone calls. Legitimate financial institutions never require customers to install customized external packages or hold physical cards against a smartphone for identity verification.
• Mobile Threat Defense (MTD): Enterprise and consumer mobile security engines must monitor for anomalous combinations of background Accessibility Service activations coupled with high-frequency NFC reader polling and outbound non-standard WebSocket connections.
• Financial Fraud Engine Telemetry: Financial institutions must enhance fraud detection heuristics to identify impossible-travel velocities (e.g., a customer interacting on a mobile banking session from one IP address while an associated contactless card transaction executes simultaneously at an ATM miles away) and flag anomalous micro-loan applications executed alongside rapid contactless point-of-sale utilization.

The deployment of the WindRelay Android Malware marks a critical evolution in cybercrime tradecraft. By leveraging the physical capabilities of mobile hardware against the victim, threat groups have demonstrated that even robust hardware-token authentication and EMV chip security can be subverted when combined with social engineering and remote device compromise.