WindRelay — a purpose-built Android NFC-relay malware installed silently by a companion remote-access trojan during the fraud call itself, with per-victim app names carrying the victim's own name
Group-IB's fraud-protection team published an analysis on 2026-08-12 of a technique rather than a single case: a previously unseen Android NFC-relay malware family it tracks as WindRelay, deployed together with SpyNote, a long-running commodity remote-access trojan, inside a live social-engineering call (Group-IB, 2026-08-12). The pairing is the finding. Prior NFC-relay tooling in this region — the modified NFCGate builds first seen in Czechia in late 2023 and their descendants — has been documented by several vendors as standalone malware the victim is talked into installing. Here the victim installs one thing and gets two.
The chain, as observable behaviour. The caller impersonates a bank employee reporting a card problem and stays on the line for the whole intrusion, rather than relying on a link or a one-time code that the victim actions alone. The victim is directed to sideload an application from outside the official store. That application is SpyNote, compiled for this target: Group-IB records that its app label and package carry the victim's own name, which the builder toolkit supports natively, and describes the purpose as trust abuse — an app already bearing your name reads as proof the caller knows who you are, and removes the unfamiliar-name check victims are trained on. Once the trojan holds Android accessibility permissions, the operator uses them to install the second component: "SpyNote’s Accessibility Service access lets the fraudster sideload and activate the NFC app silently, with no screen sharing ever triggered" (Group-IB, 2026-08-12). That property is what defeats the control most banks have deployed: screen-share detection never fires, because no screen is shared.
WindRelay's requested permissions read as a design specification for the fraud rather than a grab-bag: near-field communication to capture card data at the moment the victim is asked to tap, network access to relay the captured exchange in real time to a second device the fraudster presents to a physical terminal, contacts access for onward targeting, an unusual diagnostic-dump permission for inspecting the device and its security tooling, and custom self-declared permissions that hinder interoperation with security software (Group-IB, 2026-08-12). The documented case was monetised through two channels inside one 13-minute call — a digital loan taken out through the trojan's access to the banking application, and a card-present cash-out through the relay — which Group-IB presents as a deliberate dual-monetisation pattern rather than an improvisation.
Scale and geography come from sample correlation rather than victim reports: "We identified 23 samples uploaded to VirusTotal between November 2025 and July 2026", mimicking institutions in Czechia, Slovakia and Slovenia with text localised per country, some carrying personalised interface elements including the victim's name — which Group-IB reads as evidence the operator can build per-victim applications on demand (Group-IB, 2026-08-12).
Detection concepts. Group-IB's own guidance is unusually concrete and centres on timing rather than identity: "Alert installations of apps from non-official sources (package installer, not Play Store) that occur during an active call. This timing pattern is a strong signal on its own, independent of what the app does." (Group-IB, 2026-08-12) Alongside it: accessibility-service grants followed within minutes by a second sideload with no screen-share session; applications granted device-administrator privileges shortly after a call begins; and building detection around permission sets rather than known-sample hashes, which is what catches a family that recompiles itself per victim. On the account side, the dual-monetisation shape gives a correlation rule the bank owns entirely — a loan disbursement and a card-present transaction for the same customer within a short window, which Group-IB notes is unusual for genuine activity.
Triage: sideloading, accessibility grants and NFC use are each individually legitimate on Android, which is why none of them alone is the signal. The discriminators the mechanism forces are sequence and timing: the install arrives from the package installer rather than the store, it happens while a call is in progress, a second install follows the accessibility grant without any user-visible remote-control session, and the newly installed application requests near-field communication together with diagnostic-dump and self-defined permissions — a combination an ordinary consumer application has no reason to hold.
SpyNote’s Accessibility Service access lets the fraudster sideload and activate the NFC app silently, with no screen sharing ever triggered.
We identified 23 samples uploaded to VirusTotal between November 2025 and July 2026.
Alert installations of apps from non-official sources (package installer, not Play Store) that occur during an active call. This timing pattern is a strong signal on its own, independent of what the app does.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1566.004Phishing: Spearphishing Voice
Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.
Execution TA0002
T1204.002User Execution: Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
Command and Control TA0011
T1219Remote Access Tools
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Exfiltration TA0010
T1041Exfiltration Over C2 Channel
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Impact TA0040
T1657Financial Theft
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.