Full Report
A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal live card data and send it to attackers in real time. [...]
Analysis Summary
# Tool/Technique: WindRelay & SpyNote RAT
## Overview
WindRelay is a specialized Android malware designed to relay Near-Field Communication (NFC) data from a victim's physical payment card to an attacker's device in real-time. In recent campaigns, it is deployed as a secondary payload via the **SpyNote RAT**, a well-known Remote Administration Tool. Together, these tools allow attackers to perform remote banking fraud and physical point-of-sale (POS) transactions simultaneously.
## Technical Details
- **Type:** Malware Family (NFC Relay / RAT)
- **Platform:** Android
- **Capabilities:** NFC data relaying, remote device control, credential theft, SMS interception, and social engineering enablement.
- **First Seen:** November 2025 (WindRelay specific samples)
## MITRE ATT&CK Mapping
- **[TA0027 - Initial Access]**
- T1444 - Masquerading (Disguised as legitimate banking/utility apps)
- **[TA0030 - Execution]**
- T1626 - Abuse Visibility/Accessibility Features (Accessibility Services)
- **[TA0035 - Collection]**
- T1417.002 - Input Capture: Keylogging
- T1430 - Location Tracking
- **[TA0037 - Command and Control]**
- T1436 - Communication Discovery (C2 communication)
- **[TA0009 - Persistence]**
- T1624 - Event Triggered Execution (Accessibility Services)
- **[Exfiltration - Impact]**
- **NFC Relay (Custom Technique):** Real-time relay of ISO 14443 card data.
## Functionality
### Core Capabilities
- **NFC Relay:** Turns the victim's smartphone into a rogue contactless reader. It captures the card's transaction-specific authentication data and relays it over the internet.
- **Remote Access (SpyNote):** Provides full control over the device, allowing the attacker to view the screen, interact with apps, and install further malware (like WindRelay) without victim interaction.
- **Data Theft:** Steals SMS (for 2FA bypass), contacts, call logs, and GPS location.
- **Financial Fraud:** Enables attackers to apply for loans using the victim's banking app while the victim is on the phone.
### Advanced Features
- **Real-Time Transaction Cloaking:** Attackers use the relayed data at a genuine payment terminal in a different location while the victim believes they are "verifying" their card.
- **Social Engineering Integration:** The toolset is designed to be used during live phone calls, where the attacker masquerades as bank support.
- **Personalized APKs:** Builder frameworks allow attackers to customize app labels with the victim's actual name to increase perceived legitimacy.
## Indicators of Compromise
- **File Hashes:** (Specific MD5/SHA256 hashes not provided in the text, but nearly two dozen samples exist on VirusTotal).
- **Network Indicators (Defanged):**
- Four C2 IP addresses (Specifics not listed, but associated with Czechia, Slovakia, and Slovenia targeting).
- C2 communication typically involves ports associated with SpyNote/SpyMax.
- **Behavioral Indicators:**
- Requests for "Accessibility Services" permissions by non-system apps.
- Unexpected NFC activation or requests for the user to tap a card.
- Sideloading of APKs during a phone call with "bank support."
## Associated Threat Actors
- Unknown (Targeting specifically focused on **Czechia, Slovakia, and Slovenia**).
## Detection Methods
- **Signature-based detection:** Monitoring for known SpyNote/SpyMax code signatures and WindRelay's NFC manipulation libraries.
- **Behavioral detection:** Flagging apps that request both `NFC` and `BIND_ACCESSIBILITY_SERVICE` permissions simultaneously.
- **Network Monitoring:** Detection of persistent connections to known malicious C2 infrastructures used by SpyNote variants.
## Mitigation Strategies
- **Prevention measures:** Disable NFC when not in use; never sideload APKs (especially during a phone call).
- **Hardening recommendations:** Restrict "Accessibility Services" for all third-party apps; use biometric-protected banking apps that do not rely solely on SMS for high-value transactions.
- **Procedural:** Verify bank communications by hanging up and calling the official number listed on the back of the physical payment card.
## Related Tools/Techniques
- **NGate:** A similar Android malware family that uses NFC for card cloning/relaying.
- **NFCShare / SuperCard X / RelayNFC:** Other specialized Android NFC relay tools.
- **SpyMax / CypherRAT:** Variants and successors of the SpyNote RAT source code.