Threats Affecting Slovenia

WindRelay is a newly identified malware family that operates in conjunction with the SpyNote RAT to facilitate sophisticated contactless payment fraud. Fraudsters use social engineering via live phone calls to trick victims into installing a personalized RAT labeled with the victim's name. This RAT silently deploys WindRelay, which captures NFC contactless payment card data when victims tap their cards to their phones. The stolen data is relayed in real-time to fraudster-controlled terminals for immediate fraudulent transactions, including physical purchases and ATM withdrawals. The scheme combines digital loan fraud via the RAT with NFC-based card-present fraud. Group-IB reported 23 WindRelay samples targeting victims in Czechia, Slovakia, and Slovenia between November 2025 and July 2026.

MediumMalwareCzechiaPolandSlovakia+1#windrelay#android banking trojan#ghost tapping

Kratos is a mature Phishing-as-a-Service operation targeting Microsoft 365 users across the United States, Europe, and other regions. The platform enables attackers to steal credentials through trusted platforms, anti-bot verification, and convincing login pages. Researchers traced three generations of the kit and uncovered 1,484 previously unattributed detonations. The operation targets organizations across more than 20 countries with particularly strong concentration in the US, Spain, and Southern Europe. Kratos includes an operator panel allowing deployment of phishing domains, configurable Telegram or email delivery, geographic restrictions, and multiple anti-bot systems. The kit has evolved through three page generations (V0, V1, V2) with different exfiltration code. Activity has been visible since January 2026, with the operator panel active since September 2025.

MediumCampaignUnited StatesAustriaBelgium+8#microsoft 365#kratos#united states