WindRelay: a 13-minute call turns a phone into a card relay

A caller says they're from your bank. Thirteen minutes later they have taken out a loan in your name and are tapping your card at a store you have never been to. That is not a hypothetical — it is the case Group-IB walked through this week, tracking new NFC relay malware it calls WindRelay. For anyone who takes contactless payments, the interesting part isn't the malware. It's that a normal-looking tap at your terminal can now be a card that is nowhere near your store.

What actually happened

Group-IB published its technical writeup on August 12. The chain it documented:

1. A live voice call. An attacker impersonating a bank employee talks the victim through installing an Android app. The first payload is a personalized SpyNote variant — the app label uses the victim's own name, so a sideloaded APK looks familiar instead of suspicious.
2. Accessibility abuse. SpyNote uses Android's Accessibility Service permissions to silently install a second app: WindRelay. The victim never approves it.
3. The tap. The victim is told to hold their physical card against the phone and enter their PIN, framed as verifying or securing the card.
4. The relay. WindRelay captures the live EMV contactless exchange and relays it through attacker infrastructure to a second Android device, which is what actually presents the card.

In the case Group-IB investigated, the attackers also used their access to take out a digital loan through the victim's own banking app — account takeover and physical cash-out in one session.

Scope, per Group-IB: 23 samples uploaded to VirusTotal between November 2025 and July 2026, impersonating financial institutions in Czechia, Slovakia, and Slovenia. The firm first spotted the family in late August 2025.

Why NFC relay fraud matters for your business

Two things, and neither requires you to be a bank.

Your terminal can't tell. A relayed tap is a real card doing a real EMV exchange. Your reader sees a valid contactless transaction. Detection has to come from your processor's fraud signals — velocity, geography, card-not-typical patterns — which means knowing what your processor actually flags and whether anyone reads those alerts. If the answer is "nobody," that's a fifteen-minute fix.

The attack chain is the boring part. Phone call, sideloaded APK, accessibility permissions. Nothing exotic. That same chain works against your staff — it's how the Brinks Home breach ran, and it's how most vishing lands. On any company Android: block sideloading, lock down Accessibility Service grants, and enforce it with policy rather than a memo. And write down the rule your team can repeat under pressure — a caller who wants you to install something is the attack, every time.

Sources: Group-IB — Gone with the WindRelay, The Hacker News.