Attackers Use Vishing Attacks to Distribute New Android Malware

Researchers at Group-IB detail "WindRelay", an Android malware campaign that combines a RAT (Spynote-like) and an NFC relay to enable phone-call social engineering fraud: attackers call victims posing as bank staff, guide them to install a RAT, which is then used to silently install NFC relay malware to capture card taps and PINs and execute fraudulent transactions and loans. Group-IB observed the attackers complete an entire theft in as little as 13 minutes, streaming card data to a fake terminal while the victim remained on the call.