SpyNote and WindRelay Combo Empties Bank Accounts via NFC Relay Fraud

WindRelay is a newly identified Android NFC relay tool that Group-IB observed being deployed alongside the established SpyNote remote administration tool in a live fraud case. According to the researchers, an attacker called a victim while posing as a bank employee, claiming there was a problem with their payment card. During the call, the victim was talked into sideloading an app disguised as a legitimate tool, personalized with the victim's own name to appear credible, and granting it Accessibility Service permissions.

That sideloaded app was SpyNote, which gave the attacker full remote access to the device. Without any further action from the victim, the attacker then installed WindRelay silently and used the victim's own banking app to apply for a loan in their name. Group-IB says the entire sequence, from the initial call to the completed fraud, took 13 minutes.

While the loan application ran in the background, the caller instructed the victim to tap their physical payment card against the phone and enter its PIN. WindRelay turned the compromised device into a fraudulent contactless reader, capturing the live NFC exchange, including transaction-specific authentication data generated for that session, and streaming it in real time to the attacker's own device.

The attacker then used that relayed data to authorize a purchase at a genuine point-of-sale terminal, with the transaction approved using the same PIN the victim had just entered. Group-IB notes this differs from most current Android banking malware, which typically relies on live screen sharing or VNC-style remote viewing; here, the fraud ran entirely on Accessibility-based remote control plus a phone-call script, without the attacker ever seeing the victim's screen in real time.

Group-IB's researchers say the SpyNote-WindRelay pairing suggests a toolkit built to serve two fraud paths from one compromise: using SpyNote's device access to move money directly through the victim's banking app, and using WindRelay as a parallel cash-out channel through cloned card transactions at physical terminals. That dual capability increases the total loss per victim compared with malware that only supports one fraud method.

It also lowers the bar for attackers, since the scheme depends on social engineering and permission abuse rather than exploiting a software vulnerability. A victim who trusts the caller and follows instructions can be defrauded through a legitimate banking app and a legitimate payment terminal simultaneously, without either system flagging anything unusual at the point of transaction.

• Group-IB identified nearly two dozen WindRelay samples submitted to VirusTotal between November 2025 and July 2026.
• Those samples communicated with four distinct command-and-control IP addresses, according to the researchers.
• Based on the organizations impersonated and the languages used in the malicious apps, targeting appears concentrated on Czechia, Slovakia, and Slovenia.

The SpyNote RAT itself is not new: it and variants such as SpyMax and CypherRAT have circulated since at least 2021, with a documented rise in detections in late 2022 and early 2023 following a leak of the malware's source code, per BleepingComputer's reporting on Group-IB's research. SpyNote's broader capabilities include stealing banking, Facebook, and Google credentials, harvesting Google Authenticator codes, tracking GPS location, intercepting SMS messages, and activating the device microphone and camera.

WindRelay joins a growing list of Android NFC relay families documented in 2025 and 2026, including NFCShare, NGate, SuperCard X, and RelayNFC. In the typical version of this attack, a victim installs a malicious app and grants it NFC access, then a caller uses social engineering to get them to tap their card against the compromised phone. The phone reads the contactless card data and forwards it over the internet to the attacker's device, where it can be used for point-of-sale purchases or, depending on the data captured, ATM withdrawals.

Separately, BleepingComputer has reported on another active Android threat, Manic malware, which ThreatFabric says has targeted at least 169 banking, government, payment, and crypto-wallet apps since at least February 2026, focused primarily on users in Ukraine. Manic uses Accessibility-based keylogging and an unusual peer-to-peer exfiltration mechanism over Wi-Fi Direct or Bluetooth when it cannot reach its command-and-control server, illustrating how quickly Android fraud tooling is diversifying beyond simple overlay attacks.

• Avoid installing APK packages from outside Google Play unless the publisher is known and trusted.
• Be cautious with any app that requests NFC access or Accessibility Service permissions, especially one received or suggested during an unsolicited phone call.
• If a caller claiming to be from your bank asks for urgent action, end the call, dial the number listed on the bank's official website, and ask to be connected to the same support agent.
• Treat any request to tap your payment card against your phone during a phone call as a red flag, since banks do not need customers to do this to resolve card issues.

Victims can lose money twice in one call: a fraudulent loan issued through their own banking app, and a cloned live NFC transaction used at a real payment terminal.

Security: Unlike most modern Android malware that relies on live screen sharing or VNC sessions, this toolkit enabled the attackers to commit fraud through social engineering over the phone combined with Accessibility abuse and NFC relay.

Privacy: Beyond financial data, SpyNote variants can access SMS, GPS location, Google/Facebook credentials, Authenticator codes, camera, and microphone once Accessibility permissions are granted.

Group-IB documented a case where SpyNote and a new NFC relay tool, WindRelay, were combined to file a fraudulent loan and relay live card data in a single 13-minute call.