Android malware combo takes out loans and relays victims' credit cards

A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal card data and send it to attackers in real time.

In an incident investigated by the cybersecurity company Group-IB, a fraudster impersonated a bank employee and called the victim under the pretense of a problem with their payment card.

During the call, the threat actor instructed the victim to sideload the SpyNote RAT disguised as a legitimate app and grant it Accessibility Service permissions, giving the attacker remote access to the Android device.

To add credibility, the attacker personalized the malicious app label with the victim's name.

After gaining remote access to the device through SpyNote, the attacker installed WindRelay without further interaction with the victim and used the banking app to take out a loan in the victim’s name.