WindRelay Turns Android Phones Into Fake Payment Terminals for Remote Card Fraud

Group-IB describes WindRelay, a newly identified Android malware family used alongside a SpyNote RAT to convert victims' phones into live NFC relay devices during social-engineered vishing calls, enabling real-time card-present fraud ('ghost tap'); the report covers the attack chain (sideloaded, personalized SpyNote abusing Accessibility to install WindRelay), technical capabilities (NFC relay, internet relaying, device-inspection permissions), observed samples and C2 IPs across several European countries, IOCs, and recommended detection/mitigation guidance for banks and defenders.