Group-IB has discovered a new Android malware family dubbed WindRelay, designed to capture and relay contactless payment card NFC data in real time. On August 13, 2026, Malwarebytes published a detailed analysis reporting the research findings: the attack, paired with the SpyNote RAT, allows criminals to remotely control the victim's device during a social-engineering phone call, turning the phone into an active relay for remote physical fraud.
- WindRelay is an NFC relay malware family discovered by Group-IB and reported by Malwarebytes: it captures contactless data and relays it to criminals in real time.
- SpyNote, an Android RAT, is installed during social-engineering calls impersonating banks and enables the silent installation of WindRelay.
- The phone call serves simultaneously as the lure and as a synchronous control channel to coordinate attack timing.
- The mechanism exploits contactless cards' dynamic one-time cryptograms, making real-time relay necessary instead of static cloning.
The Mechanism: From Fake Bank Call to Active Relay
The initial vector is a phone call. Criminals contact the victim impersonating a bank operator and, over a conversation lasting roughly 13 minutes, convince them to install a fraudulent application bearing the bank's name. According to the report cited by Malwarebytes, that app contains SpyNote, an Android RAT that gives attackers full remote control of the device.
From that point, SpyNote enables the silent installation of a second application: WindRelay. The criminals remotely open the legitimate banking app already installed on the victim's phone and, in at least one documented case, obtain a loan in the victim's name. The victim is then induced to bring their physical card close to the phone and enter their PIN. At that precise moment, WindRelay captures the contactless data and relays it in real time to the device controlled by the criminals.
"The telephone call isn't just the lure. It's also the attackers' control channel." — Malwarebytes
Why Relay Beats Cloning: The Division of Labor
The technical novelty of WindRelay lies not in cloning the card — impossible with modern contactless cards — but in the real-time relay of dynamic cryptograms. Contactless cards generate one-time cryptographic codes that cannot be reused. For this reason, the malware must capture and relay every single transaction at the exact moment it occurs.
According to the source, this division of roles is the significant element: SpyNote handles remote access and phone control, while WindRelay handles the NFC side. The two pieces of malware operate in sequence, coordinated by the phone call acting as a common clock. The attacker knows exactly when the victim is about to tap the card and can synchronize the relay.
This separated architecture overcomes the limitation of previous NFC skimming techniques, which required physical proximity or static data recording. With WindRelay, the geographic distance between victim and fraudulent point of use becomes irrelevant, provided the relay connection remains stable at the moment of the transaction.
The Documented Case: 13 Minutes to Compromise an Account
The dossier reports a concrete attack in which the duration of the social-engineering call is measured: approximately 13 minutes. In that window, the victim installed the malicious app, granted the necessary permissions, followed the "operator's" instructions, and tapped their card to the phone. The attackers obtained a loan in the victim's name and completed the relay of contactless data.
The source does not specify the total number of victims, the geographic scope of observed campaigns, or details of the relay protocol WindRelay uses to transmit data to criminal servers or devices. It also does not indicate whether the malware is distributed exclusively via induced sideloading or is present on alternative stores. The dossier documents no iOS variants: all technical details refer to the Android platform.
What to Do Now
For Android users, the primary defense is recognizing social-engineering calls impersonating banks. No legitimate financial institution requires installation of applications outside its official store during a phone call. The 13-minute duration of the documented case shows criminals invest time to build trust: hanging up and contacting the bank independently breaks the attack chain.
For financial institutions, the WindRelay case requires treating contactless transactions initiated during active voice calls as a high-risk factor. Real-time relay renders controls based solely on geolocation or historical card patterns ineffective: the victim and the NFC data are physically in the same place, even though the criminal is remote.
For mobile security teams, Malwarebytes confirms detection of SpyNote and WindRelay in its Android solutions. The presence of a RAT like SpyNote is the early indicator: its detection must trigger a full device scan before WindRelay can be installed.
A Shifting Boundary: From Phishing to Physical Fraud
The significance of WindRelay lies in how it recomposes the crime chain. Telephone social engineering, traditionally associated with credential theft or infostealer installation, here becomes the connector between remote fraud and physical fraud. The phone is no longer just the vehicle of the scam: it is the tool that makes the scam possible, acting as a bridge between the card in the victim's hand and the payment terminal in the criminal's hand.
For the financial sector, this mechanism raises questions the dossier does not explore: current anti-fraud countermeasures based on transaction geolocation or user behavior are partially inadequate when relay occurs in real time during an active voice call. The distinction between "legitimate user paying" and "user induced to pay under remote control" thins in a problematic way.
Malwarebytes confirms it detects SpyNote and WindRelay in its Android solutions. Group-IB's discovery, reported by the source, confirms the threat model is evolving toward greater integration between remote access tools and hardware-interfacing tools — NFC in this case — that exploit smartphone peripherals in ways malware could not achieve a few years ago.
Information is based on the cited source and current as of publication.