A newly identified Android malware family, named WindRelay, has emerged as a significant threat in the realm of mobile security, specifically targeting near field communication (NFC) functions for fraudulent activities. This malicious software is being used alongside a known remote access trojan (RAT) called SpyNote, creating a sophisticated scheme for contactless payment fraud.
How WindRelay Exploits NFC Technology
WindRelay’s primary function is to capture live card data through NFC, transmitting it to cybercriminals instantly. Initially detected in late August 2025, the malware operates silently, with no visible activity on the user’s screen. It exploits SpyNote’s Accessibility Service to covertly sideload and activate the NFC application. This method allows attackers to bypass user detection and interaction.
The infection method often involves social engineering techniques such as phishing, smishing, or vishing. Victims are tricked into downloading a malicious app, which then uses the RAT capabilities of SpyNote to install the NFC relay malware without further user consent. The attackers personalize the APK file with the victim’s details, adding a layer of credibility to their deceitful strategy.
The Mechanics of the Fraud Scheme
Once the malware is active, victims are manipulated into using their payment cards on their compromised devices, supposedly for identity verification or PIN updates. This action transforms their smartphones into unwitting intermediaries for fraudulent transactions, as the malware intercepts and broadcasts the card’s radio signals to a separate device controlled by the fraudsters.
WindRelay consists of two synchronized components: a reader on the victim’s phone and an emulator on the attacker’s device. These components communicate via a command-and-control infrastructure, facilitating the real-time exchange of EMV APDU commands between the payment terminal and the card.
Implications and Future Outlook
WindRelay’s introduction marks an alarming development in Android-based NFC relay malware, which has spread from the Czech Republic to countries like Brazil, Poland, and Slovakia. This method, often referred to as Ghost Tap, is advantageous for cybercriminals because it allows them to remain anonymous while executing large-scale financial frauds.
According to ESET, the potential for creating networks of Android devices loaded with stolen card data is substantial, enabling automatic fraudulent transactions. Group-IB’s analysis highlights the malware’s dual functionality, combining NFC relay techniques with RAT capabilities to maximize financial extraction from victims.
Between November 2025 and July 2026, 23 WindRelay samples have been identified on VirusTotal, masquerading as financial institutions across Central Europe. This case underscores the evolving nature of Android malware, where attackers leverage a combination of social engineering, RATs, and NFC relay to exploit both digital and physical financial channels simultaneously.
