New WindRelay Android Malware Turns Phones into NFC Relays for Contactless Payment Fraud

A previously unseen Android near field communication (NFC) relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan (RAT) called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to capture live card data via NFC and transmit it to fraudsters in real time. It was first detected in 2026, with the report published on August 13, 2026.

WindRelay represents a novel approach to payment fraud, turning victims' smartphones into NFC relays that can intercept and forward card data to attackers. The malware likely requires physical proximity to a payment terminal or another NFC reader to capture the data, which is then relayed to the fraudster in real time, enabling unauthorized transactions.

The campaign combines WindRelay with SpyNote, a well-known Android RAT that provides remote access and control over the infected device. This dual-malware approach suggests a sophisticated operation, possibly targeting users who have enabled NFC on their devices and may be vulnerable to social engineering or malicious app installations.

While the exact distribution methods and geographic targeting are not yet confirmed, the use of NFC relay techniques indicates a shift toward more direct and real-time payment fraud. The impact on victims could include unauthorized contactless payments and financial loss, as the malware captures live card data without the victim's knowledge.

Group-IB's findings highlight the evolving threat landscape, where mobile devices are increasingly used as tools for financial fraud. The research underscores the need for users to be cautious about app permissions, especially those related to NFC, and to keep their devices updated with the latest security patches.

As of the report, no specific patch or mitigation details have been provided. However, users are advised to review installed apps, disable NFC when not in use, and avoid installing applications from untrusted sources. Organizations should also monitor for unusual NFC activity on managed devices and educate employees about the risks of enabling NFC and granting unnecessary permissions.