WindRelay

WindRelay — a purpose-built Android NFC-relay malware installed silently by a companion remote-access trojan during the fraud call itself, with per-victim app names carrying the victim's own name

Group-IB's fraud-protection team published an analysis on 2026-08-12 of a technique rather than a single case: a previously unseen Android NFC-relay malware family it tracks as WindRelay, deployed together with SpyNote, a long-running commodity remote-access trojan, inside a live social-engineering call (Group-IB, 2026-08-12). The pairing is the finding. Prior NFC-relay tooling in this region — the modified NFCGate builds first seen in Czechia in late 2023 and their descendants — has been documented by several vendors as standalone malware the victim is talked into installing. Here the victim installs one thing and gets two.

The chain, as observable behaviour. The caller impersonates a bank employee reporting a card problem and stays on the line for the whole intrusion, rather than relying on a link or a one-time code that the victim actions alone. The victim is directed to sideload an application from outside the official store. That application is SpyNote, compiled for this target: Group-IB records that its app label and package carry the victim's own name, which the builder toolkit supports natively, and describes the purpose as trust abuse — an app already bearing your name reads as proof the caller knows who you are, and removes the unfamiliar-name check victims are trained on. Once the trojan holds Android accessibility permissions, the operator uses them to install the second component: "SpyNote’s Accessibility Service access lets the fraudster sideload and activate the NFC app silently, with no screen sharing ever triggered" (Group-IB, 2026-08-12). That property is what defeats the control most banks have deployed: screen-share detection never fires, because no screen is shared.

WindRelay's requested permissions read as a design specification for the fraud rather than a grab-bag: near-field communication to capture card data at the moment the victim is asked to tap, network access to relay the captured exchange in real time to a second device the fraudster presents to a physical terminal, contacts access for onward targeting, an unusual diagnostic-dump permission for inspecting the device and its security tooling, and custom self-declared permissions that hinder interoperation with security software (Group-IB, 2026-08-12). The documented case was monetised through two channels inside one 13-minute call — a digital loan taken out through the trojan's access to the banking application, and a card-present cash-out through the relay — which Group-IB presents as a deliberate dual-monetisation pattern rather than an improvisation.

Scale and geography come from sample correlation rather than victim reports: "We identified 23 samples uploaded to VirusTotal between November 2025 and July 2026", mimicking institutions in Czechia, Slovakia and Slovenia with text localised per country, some carrying personalised interface elements including the victim's name — which Group-IB reads as evidence the operator can build per-victim applications on demand (Group-IB, 2026-08-12).

Detection concepts. Group-IB's own guidance is unusually concrete and centres on timing rather than identity: "Alert installations of apps from non-official sources (package installer, not Play Store) that occur during an active call. This timing pattern is a strong signal on its own, independent of what the app does." (Group-IB, 2026-08-12) Alongside it: accessibility-service grants followed within minutes by a second sideload with no screen-share session; applications granted device-administrator privileges shortly after a call begins; and building detection around permission sets rather than known-sample hashes, which is what catches a family that recompiles itself per victim. On the account side, the dual-monetisation shape gives a correlation rule the bank owns entirely — a loan disbursement and a card-present transaction for the same customer within a short window, which Group-IB notes is unusual for genuine activity.

Triage: sideloading, accessibility grants and NFC use are each individually legitimate on Android, which is why none of them alone is the signal. The discriminators the mechanism forces are sequence and timing: the install arrives from the package installer rather than the store, it happens while a call is in progress, a second install follows the accessibility grant without any user-visible remote-control session, and the newly installed application requests near-field communication together with diagnostic-dump and self-defined permissions — a combination an ordinary consumer application has no reason to hold.