"The entire activity occurred in a 13-minute phone call," Group‑IB reports — a short, tightly choreographed fraud that combined a remote administration tool and a novel Android NFC relay to both seize accounts and monetize payment cards in real time.
How Group‑IB reconstructed the 13‑minute scam
According to the researchers, the attack began with a social‑engineering phone call in which the fraudster impersonated a bank employee and told the victim there was a problem with their payment card. During that call the victim was instructed to sideload an application that was in fact the SpyNote remote administration tool (RAT), disguised as a legitimate app and personalized with the victim's name to add credibility. The victim granted the app Accessibility Service permissions, giving the attacker remote control of the device.
Once SpyNote provided remote access, the attacker installed a second component — WindRelay — without further interaction from the victim, then used the victim's banking app to apply for a loan in the victim’s name. The caller also instructed the victim to tap their card against the phone and enter their PIN; WindRelay converted the infected phone into a fraudulent contactless reader and relayed the live NFC exchange to the attacker’s device, including transaction‑specific authentication data. Group‑IB reports that transactions at a real payment terminal were approved using the PIN supplied during the call.
SpyNote and WindRelay: complementary roles in a single toolkit
Group‑IB characterizes the combination of SpyNote and WindRelay as a toolkit that supplies both device access and a direct cash‑out channel. SpyNote — and variants named in the report, including SpyMax and CypherRAT — has been in circulation since at least 2021; detections rose after the malware’s source code leaked in late 2022 and early 2023. The RAT can steal bank data, Facebook and Google credentials, Google Authenticator codes, GPS coordinates, SMS texts and can activate the microphone and camera; it also can intercept keystrokes.
WindRelay, by contrast, focuses on NFC relay: capturing the contactless interaction between a phone’s NFC interface and a payment card and transmitting that data to an attacker. Used together, the two components allow an attacker to control apps on the device for account manipulation while simultaneously harvesting live card data for immediate fraud.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildNFC relay mechanics and how attackers cash out
The researchers explain that WindRelay turns an infected Android phone into a fraudulent contactless reader. When victims follow social‑engineering instructions and tap their payment card to the compromised phone, the device communicates with the card and captures whatever data is available. That data — Group‑IB reports — can include transaction‑specific authentication elements that an attacker can relay to their own device and use at a genuine payment terminal. The report also notes that, depending on what data is obtained and the technique used, attackers may be able to use captured NFC data for fraudulent transactions or other forms of financial theft, including ATM cash withdrawals.
Group‑IB points out a notable difference from many modern Android scams: this attack succeeded solely through a phone call and social manipulation rather than by relying on live screen sharing or VNC features. The result was a rapid, real‑time theft cycle: access, credential and card capture, and cash‑out within minutes.
Targeting, samples, and observed infrastructure
Group‑IB identified almost two dozen WindRelay samples submitted to VirusTotal between November 2025 and July 2026; those samples communicated with four command‑and‑control IP addresses. Based on the organizations impersonated during calls and the languages used, the researchers say targeting appears concentrated on Czechia, Slovakia and Slovenia.
What this means for technologists, banks, and end users
- Technologists and security teams: expect attacker toolkits that combine remote control (RATs) with payment‑channel malware; visibility should extend beyond initial access to the cash‑out stage, and defenses must account for credential‑validity exploitation after access is obtained. Group‑IB also notes that "overall prevention scores can hide what happens after initial access," citing the Blue Report 2026, which measured defenses across 338 million simulations.
- Banks and payment operators: fraud that mixes social engineering, device compromise and NFC relay can authorize transactions at legitimate terminals. Authentication flows that rely on transaction data and PIN entry can be abused when attackers obtain both remote access and live card data.
- End users: Group‑IB recommends avoiding APK packages outside Google Play unless you know and trust the publisher, and being cautious about apps that request NFC access or other dangerous permissions. If you receive a call purporting to be from your bank asking for urgent action, the advice is to terminate the call, then dial the number listed on the organization’s official website and ask to be connected to the same support agent.
Two facts stand out: the rapidity of the operation — completed in about 13 minutes — and the attackers’ ability to bypass the need for screen‑sharing tools by performing everything through a scripted phone interaction. For defenders, that combination underlines a hard truth Group‑IB signals in its findings: once valid credentials or live transaction data are in an attacker’s hands, conventional prevention metrics can drop sharply. For users, the guidance is simple and specific — avoid sideloaded APKs you do not trust, scrutinize NFC and Accessibility permissions, and always verify urgent bank calls via official contact channels.
