Full Report
A previously unseen Android near field communication (NFC) relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan (RAT) called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to capture live card data via NFC and transmit it to fraudsters in real time. It was first detected in
Analysis Summary
# Tool/Technique: WindRelay
## Overview
WindRelay is a specialized Android malware family designed to facilitate contactless payment fraud via Near Field Communication (NFC) relay attacks. It operates in tandem with the **SpyNote RAT** to turn a victim's infected smartphone into a live "payment proxy." By capturing radio signals from a physical payment card and transmitting them to a remote attacker in real-time, it allows fraudsters to perform unauthorized card-present transactions (EMV) at physical point-of-sale (PoS) terminals or ATMs.
## Technical Details
- **Type:** Malware Family (NFC Relay / Financial Trojan)
- **Platform:** Android
- **Capabilities:** Real-time NFC data interception, WebSocket communication, EMV APDU command relaying, and silent sideloading via Accessibility Services.
- **First Seen:** August 2025 (Active through 2026)
## MITRE ATT&CK Mapping
- **[TA0031 - Lateral Movement]** (Note: In mobile context, often used for relaying credentials/access)
- **[TA0035 - Collection]**
- **[T1429 - Capture Device Data]** (NFC Radio Signal Interception)
- **[TA0037 - Command and Control]**
- **[T1090.003 - Proxy: Multi-hop Proxy]** (Relaying payment data through victim device)
- **[T1071.001 - Application Layer Protocol: Web Protocols]** (WebSocket usage)
- **[TA0027 - Persistence]** / **[TA0028 - Privilege Escalation]**
- **[T1418 - Abuse Accessibility Features]** (Used by the companion SpyNote RAT to install WindRelay)
## Functionality
### Core Capabilities
- **NFC Reader Component:** The malware acts as a reader on the victim's device. When a victim taps their physical card against the phone, WindRelay captures the EMV (Europay, Mastercard, and Visa) APDU commands.
- **Real-Time Relay:** It establishes a WebSocket connection to a C2 server to stream card data instantly to the attacker.
- **Card Emulation:** The attacker uses a separate "emulator" component to mimic the victim’s card at a physical payment terminal, completing the bridge.
### Advanced Features
- **Silent Installation:** Leverages SpyNote RAT’s Accessibility Service permissions to sideload and activate the WindRelay APK without triggering screen-sharing alerts or requiring user confirmation.
- **Personalization:** Attacks involve social engineering calls where the malicious APK is customized with the victim's name to increase the success rate of the sideloading pretext.
- **Dual Monetization:** Enables attackers to simultaneously perform digital fraud (via the RAT) and physical fraud (via the NFC relay).
## Indicators of Compromise
- **File Hashes:** 23 samples identified on VirusTotal (Specific hashes not listed in text, but active between Nov 2025 – July 2026).
- **File Names:** Personalized APKs (e.g., `[Victim_Name].apk`) often impersonating banking or identity verification apps.
- **Network Indicators:** WebSocket connections to attacker-controlled C2 infrastructure (Defanged: `ws[:]//[attacker-domain][.]com`).
- **Behavioral Indicators:** Unexpected activation of NFC services; sideloading of applications following a social engineering call; SpyNote RAT activity (Accessibility Service abuse).
## Associated Threat Actors
- Unknown (Current activity targets financial institutions in **Czechia, Slovakia, and Slovenia**).
## Detection Methods
- **Signature-based detection:** Identify known WindRelay and SpyNote APK signatures.
- **Behavioral detection:**
- Monitoring for high-frequency NFC data access by non-payment system apps.
- Detecting the abuse of Accessibility Services to install new packages.
- Identifying persistent WebSocket connections to known malicious or suspicious domains.
## Mitigation Strategies
- **Prevention measures:** Disable NFC when not in use; never sideload APKs from untrusted sources (especially during or after a phone call).
- **Hardening recommendations:**
- Restrict "Install Unknown Apps" permissions on Android devices.
- Be wary of "Accessibility Service" requests from non-essential applications.
- Implement mobile threat defense (MTD) solutions to detect RAT behavior.
## Related Tools/Techniques
- **SpyNote RAT:** The primary delivery mechanism providing remote control.
- **NFCGate:** A legitimate research tool often used as a base for NFC relay attacks.
- **DevilNFC / NFCMultiPay:** Similar Android NFC relay malware families.
- **Ghost Tap:** The broader technique of relaying NFC signals for fraudulent payments.