The threat involves a combination of two Android malware families: WindRelay, an NFC relay malware, and SpyNote, a remote administration tool. Attackers impersonate bank employees to trick victims into installing SpyNote with Accessibility Service permissions, granting full remote control. Using this access, attackers install WindRelay, which turns the victim's phone into a fraudulent contactless reader that relays live NFC payment card data, including transaction-specific authentication data, to the attacker. This enables real-time fraudulent transactions such as loans and purchases using the victim's card and PIN. The entire attack can be completed within a short phone call. Group-IB researchers identified multiple WindRelay samples communicating with attacker-controlled servers, with targeting focused on Central European countries. The attack chain relies on social engineering rather than exploiting technical vulnerabilities in Android itself.

The combined use of SpyNote RAT and WindRelay malware allows attackers to gain remote control of victims' Android devices and steal live NFC payment card data. This enables attackers to perform unauthorized financial transactions, including taking out loans in the victim's name and making purchases at genuine payment terminals using relayed card data and PINs. Victims suffer financial loss and potential credit damage. The attack bypasses typical Android security controls by relying on social engineering to obtain permissions and install malware. The rapid execution of the attack (within approximately 13 minutes) increases the risk of successful fraud before victims can respond.

There is no vendor patch or official fix for this malware combination as it relies on social engineering and user interaction. Users should avoid sideloading APKs from untrusted sources and be cautious about granting Accessibility Service and NFC permissions to apps. If contacted by a purported bank representative requesting urgent action, users should terminate the call and independently verify by calling the bank using official contact information. Android users should only install apps from trusted sources such as Google Play. Awareness training on social engineering tactics can help reduce risk. No specific technical remediation is available to remove or block this malware beyond standard mobile security best practices.