MalwarePublished 12 Aug 2026

Android malware combo takes out loans and relays victims' credit cards

Source Bleeping Computer

Description

WindRelay is an Android NFC relay malware used in combination with the SpyNote remote administration tool (RAT) to steal live payment card data and commit financial fraud. Attackers socially engineer victims to install SpyNote disguised as a legitimate app, granting remote access to their device. Subsequently, WindRelay is installed to relay NFC card data in real time, enabling attackers to perform fraudulent transactions including taking out loans and making purchases using the victim's card. The attack relies heavily on social engineering and occurs rapidly, often within minutes. Targeting appears focused on Czechia, Slovakia, and Slovenia. Users are advised to avoid sideloading apps from untrusted sources and be cautious with apps requesting NFC or accessibility permissions.

Impact

The combined use of SpyNote RAT and WindRelay malware allows attackers to gain remote control of victims' Android devices and steal live NFC payment card data. This enables attackers to perform unauthorized financial transactions, including taking out loans in the victim's name and making purchases at genuine payment terminals using relayed card data and PINs. Victims suffer financial loss and potential credit damage. The attack bypasses typical Android security controls by relying on social engineering to obtain permissions and install malware. The rapid execution of the attack (within approximately 13 minutes) increases the risk of successful fraud before victims can respond.

Defensive guidance

There is no vendor patch or official fix for this malware combination as it relies on social engineering and user interaction. Users should avoid sideloading APKs from untrusted sources and be cautious about granting Accessibility Service and NFC permissions to apps. If contacted by a purported bank representative requesting urgent action, users should terminate the call and independently verify by calling the bank using official contact information. Android users should only install apps from trusted sources such as Google Play. Awareness training on social engineering tactics can help reduce risk. No specific technical remediation is available to remove or block this malware beyond standard mobile security best practices.

Summary

The threat involves a combination of two Android malware families: WindRelay, an NFC relay malware, and SpyNote, a remote administration tool. Attackers impersonate bank employees to trick victims into installing SpyNote with Accessibility Service permissions, granting full remote control. Using this access, attackers install WindRelay, which turns the victim's phone into a fraudulent contactless reader that relays live NFC payment card data, including transaction-specific authentication data, to the attacker. This enables real-time fraudulent transactions such as loans and purchases using the victim's card and PIN. The entire attack can be completed within a short phone call. Group-IB researchers identified multiple WindRelay samples communicating with attacker-controlled servers, with targeting focused on Central European countries. The attack chain relies on social engineering rather than exploiting technical vulnerabilities in Android itself.

References

bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Aug 2026, 22:41 UTC

References

Community reviews

Related threats