Threats Tagged 'spynote'

A new NFC relay malware family called WindRelay has been discovered operating in combination with SpyNote RAT to enable sophisticated contactless payment fraud. The scheme uses live social engineering phone calls where fraudsters impersonate bank employees and guide victims to install personalized RAT malware labeled with the victim's own name. Once installed, the RAT enables silent deployment of WindRelay, which captures contactless payment card data via NFC when victims tap their cards to their phones. The captured data is relayed in real-time to fraudster-controlled terminals for immediate cash-out through physical purchases or ATM withdrawals. The operation employs dual monetization, combining RAT-driven digital loan fraud with NFC-based card-present transactions. Group-IB identified 23 WindRelay samples targeting victims in Czechia, Slovakia, and Slovenia between November 2025 and July 2026.

MediumMalwareCzechiaPolandSlovakia+1#windrelay#android banking trojan#ghost tapping

Researchers uncovered a fractured criminal ecosystem built around Flying Eagle, an Android remote access tool whose source code was stolen in early 2026 along with nearly 200 customer databases. The investigation began with a malicious APK impersonating a Chinese Provincial Public Security Bureau app, leading to identification of 170 active servers running the framework. Two Telegram channels, SQLRCE0 and Yx Technology, distribute modified versions with operational support and cash-out services at 20-50% transaction fees. The platform combines APK generation and C2 device management with phishing overlays targeting financial, adult, and government services. A successor platform called Night Dragon was introduced in June 2026, featuring enhanced credential capture capabilities for Chinese banking apps, cryptocurrency wallets, and social media platforms. The activity primarily targets Chinese citizens through social engineering lures, though international templates suggest broader targeting capability.

MediumMalwareChinaThailand#mobile banking fraud#spynote#telegram distribution

This analysis reveals the resurgence of SpyNote, a potent Android RAT, distributed through deceptive websites mimicking Google Play Store. The malware employs sophisticated techniques for surveillance, data exfiltration, and remote control. Recent changes include minor IP resolution adjustments and enhanced anti-analysis measures in the APK dropper. SpyNote's capabilities include keylogging, camera and microphone control, and abuse of Android's Accessibility Services. The threat actor demonstrates persistence and limited technical adaptability, targeting consumers broadly with lures mimicking popular applications. Key technique changes involve dynamic payload decryption, DEX element injection, and obfuscation of C2 logic. The campaign underscores the ongoing threat of mobile RATs and the need for vigilance against social engineering tactics.

MediumMalwareGermanyFranceUnited Kingdom+5#malware delivery#apk#android

Multiple samples of SpyNote, a sophisticated Android spyware, were discovered in open directories, disguised as legitimate apps like Google Translate, Temp Mail, and Deutsche Postbank. The malware exploits accessibility services and device administrator privileges to steal sensitive information from infected devices. Samples were found on various servers, including AWS and SonderCloud Limited, with different command and control (C2) infrastructures. The discovery highlights the ongoing threat of SpyNote, especially after its source code leak in late 2022, and emphasizes the importance of proactive threat detection and analysis.

MediumCampaignGermanyUnited KingdomFrance+2#open directories#spynote#data exfiltration