A new Android fraud operation reveals how quickly a convincing phone call can lead to financial loss. Combining SpyNote, a remote-control tool, with WindRelay, a newly tracked NFC relay malware family, criminals gain access to victims' banking apps and physical payment cards in just one session. This case demonstrates the abuse of contactless payments where a phone acts as a bridge between a legitimate card and a criminal’s device, bypassing simply storing stolen card details.
The impact extends beyond one unauthorized transaction; attackers can alter settings within a banking app, while the NFC component enables card-present payment methods that may appear authentic to merchant terminals.
SpyNote APK Builder enables customization of data (Source – Group-IB) The malicious software intercepted live NFC exchanges between a card and reader, transmitting them in real time over the internet rather than as reusable card numbers. Defenders shouldn't solely rely on known file signatures; instead, they should detect unusual permission combinations and implement out-of-band confirmation, delays, or stronger authentication for risky loan requests. If you suspect this scam, contact your bank immediately using the verified route.
Indicators of compromise (IoCs) include: - IP addresses: - 88[.]86[.]124[. ]114 - 185[.]100[.]87[. ]116 - 185[.]100[.]87[. ]223 - 213[.]218[.]160[.
]48 - Domain names: - WindRelay C2 infrastructure - SpyNote RAT malware sample These IoCs indicate potential involvement of the WindRelay and SpyNote malware.
