Cybersecurity experts from Group-IB have revealed a new and extremely dangerous tactical combination of malicious tools for the Android mobile operating system. It is a combination of the well-known remote control tool SpyNote and the newer program WindRelay, which exploits NFC technology. The main goal of the attackers is to intercept bank card data in real time and take control of the victim's device.<\/p>\n\n\n\n
The attack usually starts with a classic phone call. The scammer pretends to be a bank employee and convinces the victim that there is a problem with their payment card. To make the scam look as convincing as possible, the attacker sends the victim a customized application that even includes their name. Once the user manually installs this application and grants it access to accessibility services, the scammer gains complete remote control of the phone.<\/p>\n\n\n\n
In the next step, the attacker installs the WindRelay tool on the phone without the user\u2019s knowledge and applies for a loan on behalf of the victim via a banking app. The victim is then instructed to hold their physical bank card up to the phone and enter their PIN. At this point, WindRelay turns the phone into a fake card reader. All contactless transaction data, including security information, is transmitted in real time to the attacker\u2019s device, who can then use this data to make purchases at a real payment terminal or even withdraw cash.<\/p>\n\n\n\n
Interestingly, the attackers don't need complex screen sharing or live streaming to carry out the entire scam, but rely entirely on psychological pressure during a phone conversation. The SpyNote tool, which has been around since 2021, is capable of stealing passwords, intercepting SMS messages, two-factor authentication codes, and even turning on the microphone and camera.<\/p>\n\n\n\n
Security analysts have recorded nearly two-tenths of WindRelay samples between November 2025 and July 2026. Based on the language used and the bank brands that the attackers are imitating, the primary targets of this wave of attacks are users in the Czech Republic, Slovakia, and Slovenia.<\/p>","protected":false},"excerpt":{"rendered":"
Kibernetski varnostni strokovnjaki iz podjetja Group-IB so razkrili novo in nadvse nevarno takti\u010dno kombinacijo zlonamernih orodij za mobilni operacijski sistem Android. Gre za zdru\u017eitev znanega orodja za oddaljeni nadzor SpyNote ter novej\u0161ega programa WindRelay, ki izkori\u0161\u010da tehnologijo NFC. Glavni cilj napadalcev je v realnem \u010dasu prestre\u010di podatke o ban\u010dni kartici ter prevzeti nadzor nad napravo […]<\/p>","protected":false},"author":2,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[50],"tags":[128,478,482],"class_list":["post-8037","post","type-post","status-publish","format-standard","hentry","category-telefonija","tag-android","tag-informacijska-varnost","tag-kibernetska-varnost"],"acf":{"subtitle":"","heading":"","summary":"Nova napadalna kombinacija orodij SpyNote in WindRelay zlorablja telefonsko prevaro in NFC v pametnih telefonih Android. Napadalci od dale\u010d najemajo posojila in prena\u0161ajo podatke kartic, tar\u010da pa so tudi uporabniki v Sloveniji.","thumbnail_small":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2026\/08\/jarmoluk-money-256315_1920-560x315.jpg","thumbnail_large":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2026\/08\/jarmoluk-money-256315_1920-1024x683.jpg","thumbnail_caption":"Foto: Pixabay","gallery":"","video_gallery":null,"author":"","links":null,"sources":[{"title":"bleepingcomputer","url":"https:\/\/www.bleepingcomputer.com\/news\/security\/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards\/"}],"skip_language":[]},"yoast_head":"\n