Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme

Introduction

Contactless payment fraud has moved from a theoretical risk to an operational one, and the scale is now visible in both industry and regulatory reporting. The European Payments Council’s  2025 Payment Threats and Fraud Trends report identifies NFC relay fraud — and the related “Ghost Tap” technique — as a rising category, noting it frequently overlaps with remote access scams and results in unauthorized transactions and a complete loss of control over funds, with victims sometimes unknowingly drawn into money laundering as a result. The scale behind that assessment shows up clearly in independent telemetry: NFC-based attacks on Android devices rose 188% in the first four months of 2026 compared to the same period in 2025, with 35,600 attacks blocked in that window alone, up from over 12,300 a year earlier (Kaspersky); this followed a more than 35-fold increase in NFC-related attacks recorded in the first half of 2025 compared to the second half of 2024 (ESET).

Law enforcement attention has followed the same trajectory, and Central and Eastern Europe has been at the center of it. The first documented attacks using a modified version of the open-source NFCGate tool occurred in late 2023 in the Czech Republic (Kaspersky), and in March 2024, Czech Police confirmed the arrest of a 22-year-old individual after receiving reports of a suspicious individual withdrawing money from ATMs in Prague without using any physical card. Despite that arrest putting the group’s activity on hold at the time, the same NGate tooling was later observed spreading to other regions (ESET). That spread has continued: Zimperium researchers have tracked NFC relay campaigns broadening across Poland, the Czech Republic, and Slovakia, supported by more than 70 identified command-and-control servers and distribution hubs (Zimperium), and threat actors have gone as far as impersonating the National Bank of Slovakia directly, to lend credibility to malicious apps and obtain the NFC permissions needed to carry out the fraud (GBHackers).

Group-IB have tracked this category closely ourselves. In our own research, Ghost Tapped: Tracking the Rise of Chinese Tap-to-pay Android Malware, we documented Chinese-language Fraud-as-a-Service operations distributing NFC-enabled Android malware across Telegram, with more than 54 malicious samples identified and at least $355,000 in confirmed fraudulent transactions linked to a single point-of-sale vendor between November 2024 and August 2025 alone.

This report sits alongside that body of work, but its focus is different: rather than analyzing a single incident, we look at a technique — a new, purpose-built NFC relay malware family, tracked here as WindRelay, deployed together with a known RAT, SpyNote, inside a live-call social-engineering scheme. The case study that follows illustrates this combination in practice, but the pattern itself is what matters: RAT-driven remote access opens the device up, and NFC relay malware turns a single card tap into a cash-out channel.

Key discoveries

• A previously unseen NFC relay malware family, purpose-built to capture live card data via NFC and relay it out in real time.
• This NFC malware is deployed together with SpyNote, a known RAT. SpyNote’s Accessibility Service access lets the fraudster sideload and activate the NFC app silently, with no screen sharing ever triggered.
• This NFC + RAT pairing is a significant finding that shows the new NFC tooling is not used standalone, but as part of a combined toolkit with established remote-access malware.
• The RAT’s app label used the victim’s own name. This is a deliberate trust-abuse tactic that acts as unspoken proof that the caller already knows the victim, lowering suspicion and personal defenses.
• The NFC malware’s permission set reveals deliberate, engineered design: NFC for capture, INTERNET for real-time exfiltration, READ_CONTACTS for further targeting, an unusual DUMP permission for device inspection, and custom self-defined permissions to resist security tooling.
• Dual monetization within a single scheme: RAT-driven remote access can be used to take out a digital loan, while the NFC malware enables physical, card-present purchases..

Who may find this blog interesting:

• Cybersecurity analysts and corporate security teams
• Malware analysts
• Threat intelligence specialists
• Cyber investigators
• Computer Emergency Response Teams (CERT)
• Law enforcement investigators
• Cyber police forces

Group-IB Threat Intelligence and Fraud Protection Portals:

Group-IB customers can access our Threat Intelligence and/or Fraud Protection portals for more information about the malware and scheme described in this blog.

Threat Intelligence:

• SpyNote
• WindRelay

Fraud Protection:

• NFC Relay + RAT Banking Fraud Scheme (SpyNote + WindRelay)
• SpyNote

Description and Case Overview

The following case study, derived from an investigation supported by Group-IB’s Fraud Protection team for a client, provides a detailed illustration of how this purpose-built NFC malware, tracked as WindRelay, and the SpyNote RAT are deployed in tandem.

In one 13-minute phone call, the victim installed a RAT onto their own device — everything after that was performed by the fraudster. By the end of the call, the fraudster had taken out a loan in the victim’s name through remote access to the victim’s mobile app, and was streaming their card data to a fake merchant terminal. Every transaction was approved using the PIN the victim had entered themselves. The victim stayed on a live call with the fraudster for the entire incident.

Figure 1: Attack chain overview.

Key actions during the call, in order:

1. The fraudster called the victim posing as a bank employee, claiming a problem with their bank card.
2. The victim installed the first app — a RAT, labeled with the victim’s own name — after being guided to do so by the fraudster on the call.
3. Using the RAT’s remote access features, the fraudster then installed a second app — the NFC relay malware — without needing any additional input or action from the victim.
4. Once remote access was in place, the fraudster also took the opportunity to issue a loan in the victim’s name. Our investigation indicates that this was likely an add-on to maximize the payout, not a separately planned step.
5. The victim tapped their card to their phone and entered their PIN, as instructed.

Shortly after the call ended, physical card transactions started appearing on the victim’s account, which the bank confirmed were linked to NFC relay activity.

What exactly happened? Breaking down the scam

Utilizing a phone call as a control channel

Figure 2: Active call early detection (before the authorization).

Group-IB Fraud Protection detected an active call running for the whole session. This is an important factor in this scheme: the fraudster did not rely on one-time instructions, like a phishing link or SMS code. Instead, they kept live, real-time control over the victim throughout the attack. Every step that followed — installing apps, approving the loan — happened while the victim was being guided live on the call.

Sideloading a personalized RAT mid-call

During the same call, the Group-IB Fraud Protection detected a remote access trojan (RAT) installed through the device’s package installer — the standard way to sideload apps outside an official app store. This sample’s app label was personalized with the victim’s own name, not a generic or impersonated brand. This is possible because SpyNote is distributed with a builder toolkit that lets an operator compile each APK with a custom app name, label, and package name before deployment — personalization isn’t a manual, one-off effort, it’s a built-in option in the tooling.

Figure 4: SpyNote APK Builder allows for data customization.

The use of target-specific labels is a critical finding: it indicates a delivery process tailored to the individual rather than a generic, mass-distributed payload. This implies a degree of pre-call reconnaissance where the threat actor harvested basic PII — specifically the victim’s name and phone number — to ground the social-engineering pretext and compile a personalized APK. Such tactics are more effective at weakening a victim’s natural defenses and suspicions. It removes the one cue people are trained to check before installing something unfamiliar — a strange or generic app name — right at the moment they’re most likely to hesitate.

NFC relay malware installation

Group-IB Fraud Protection detected a second application — built to relay NFC card data — installed via the package installer while the RAT’s remote access was already active. The fraudster used that access to push the install himself, rather than the victim downloading or approving it directly, from a source with no legitimate standing on the device. This second install happened shortly after the RAT install, while the call was still ongoing.

Figure 5: NFC malware sample detection.

Analyzing the requested permissions, Group-IB researchers were able to map directly what the attacker could now do with the NFC malware:

• NFC — The core capability. Once granted, the app could read card data the moment the victim taps it to their phone, capturing what was needed to use the card at a fake terminal.
• INTERNET / ACCESS_NETWORK_STATE — Gave the attacker a live channel to send this data out in real-time, so the card could be used within moments of the tap.
• READ_CONTACTS — Let the attacker reach beyond the immediate victim, possibly to find new targets or support further social engineering.
• DUMP — An unusual permission for a third-party app. It suggests the attacker could inspect deeper device or system state, possibly to check for security tools or confirm the compromise was working.
• Custom <apk_name>.* permissions — Used to isolate the app’s internal components from other apps on the device, making it harder for security software to interfere or inspect the malware.

Together, these permissions gave the fraudster everything needed to turn one moment — the card tap — into a live, remotely usable card clone, without ever seeing the victim’s screen or needing an official app store listing.

Performing the fraud live: Card funds cash-out

With the NFC relay app active and remote access already in place, the fraudster — still on the same phone call — told the victim to tap their bank card against their phone. That tap was the moment of capture: the app read the card data via NFC and sent it out through the attacker’s remote session.

What’s stolen: Not a static card number, but the live data exchange between the card’s chip and a reader at the moment of the tap — including the one-time authentication code the card generates for that specific transaction.

How it’s stolen: The relay malware turns the victim’s phone into a fake contactless reader (like a POS). When the card is tapped to the phone, the malware communicates with the card’s chip over NFC exactly as a real POS-terminal would, capturing that live exchange instead of a terminal doing so.

How it’s transmitted: The captured exchange is streamed out over the internet, in real time, to a second device in the fraudster’s hands — not stored and reused later, but relayed as it happens. This is exactly why INTERNET permission is set on the NFC malware.

How NFC relay is used to fraudulently pay for items or withdraw funds: That second device controlled by the fraudster, presents itself as the card to a real merchant terminal or ATM, at the same moment the victim’s card is being read. In effect, the victim’s card and the real terminal are still talking directly to each other — the fraudster’s setup is just an invisible relay in between, passing the exchange back and forth across a distance. Because the terminal is genuinely completing a live handshake with a real card, the transaction goes through and processes the withdrawal or purchase as normal.

Malware Attribution

The NFC relay application is an independently developed Android malware that draws on NFC relay techniques. Using metadata of detected malicious applications, Group-IB’s Fraud Protection team correlated them to other applications used in multiple campaigns targeting victims in Czechia, Slovakia, and Slovenia. We identified 23 samples uploaded to VirusTotal between November 2025 and July 2026. The samples mimic various institutions from the targeted countries and contain text in the language of each targeted country. Some samples contain personalized UI elements and labels, such as the name of the victim, similar to the personalized RAT. This suggests the threat actor behind these campaigns most likely has the capability to dynamically build malicious applications tailored to individual victims. Group-IB Threat Intelligence tracks this malware as WindRelay. Our researchers also identified 4 Command and Control (C2) IPs used by this malware to relay NFC data. The C2 IPs and the identified VirusTotal samples are in the Indicators of Compromise section below.

The RAT’s personalization pattern and its metadata has allowed our team to attribute it to a variant of SpyNote.

VirusTotal samples connected to this case carry confirmed fraudulent attribution, corroborating both the malware family identification and the fraudulent intent behind the deployment.

Conclusion

This case shows that modern fraud rarely relies on one technique. Here, the fraudster combined three capabilities in a single session — a live social engineering call, a personalized RAT for remote device control, and an NFC relay malware for physical cash-out. The fraudster also used these capabilities to hit two separate payout channels — a digital loan and card-present purchases — before the bank or victim could react.

Beyond the details of this single case study, the tooling of the malware package in this scam scheme also presents several important indicators of an evolving fraud ecosystem:

• No screen sharing does not mean no remote access. This case shows a RAT achieving full remote control without ever triggering screen-share detection.
• The RAT’s label was personalized with the victim’s name. This points to a delivery process tailored per target, not one generic payload sent to everyone. This detail is itself useful for detection.
• Tight Timing. The NFC app was installed from a non-legitimate source shortly in a matter of minutes after the call began and the malicious RAT install.
• The fraudster used two payout channels in one session. This shows attackers diversifying how they cash out within a single victim engagement, rather than relying on a single, fixed method or script.
• This NFC relay tool is not a one-off. Using a permission- and certificate-based hunting approach, Group-IB researchers found other confirmed-fraudulent samples using the same tooling. This means the detection signature described here applies beyond this single incident.

Recommendations

Detection

• Leverage advanced Threat Intelligence  services for the latest information and updated threat feeds.
• Implementing a robust Fraud Protection session monitoring system will enable the detection of malicious applications on user devices, as well as unusual behavior and logins from compromised devices.
• Don’t rely on screen-sharing detection alone as a proxy for remote access. Add checks for RAT indicators that don’t require screen sharing — Accessibility Service abuse, sideloaded apps installed mid-call, or apps granted admin/device-admin privileges shortly after a call starts.
• Alert installations of apps from non-official sources (package installer, not Play Store) that occur during an active call. This timing pattern is a strong signal on its own, independent of what the app does.
• Build detection around app permission sets, not just known malware hashes. This can help  catch new samples before they’re individually identified.

Prevention

• Treat “personalized” app labels (using the victim’s own name) as a specific red flag in fraud awareness materials — this detail is unusual enough to be memorable and actionable for customers.
• Apply extra friction (step-up authentication, cooling-off periods, out-of-band confirmation) to loan applications submitted while other risk signals are present, such as an active call or a recently installed unfamiliar app.
• Consider velocity or correlation rules that flag when a loan disbursement and a physical card transaction occur close together for the same customer — this combination is unusual for genuine activity and matches the dual-monetization pattern seen here.

Response

• When a customer reports a fraud call, ask specifically whether they installed any apps during the call and, if possible, retrieve the app names/labels/files — this is often lost if not captured early, as it was here.
• Treat confirmed NFC relay cases as a signal to check the customer’s account for other channels that could have been touched in the same session (loans, transfers, new payees), not just the transaction type initially reported.

Acknowledgement of research support:

• Pavel Naumov, Senior Security Researcher • Global Fraud Protection BU

Group-IB Fraud Matrix

Indicators of Compromise (IOCs)

WindRelay NFC Malware IOCs

SpyNote RAT Malware IOCs

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Telegram and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.