DEV Community

Anoymask
Anoymask

Posted on

WindRelay + SpyNote: Phone Remote Control and NFC Relay for Loan and Card Fraud

#security #threatintel

WindRelay + SpyNote: Phone Remote Control and NFC Relay for Loan and Card Fraud

1. Basic Information

2. Summary

This is a complex financial fraud scheme. Attackers call victims while posing as bank staff. They trick victims into installing a SpyNote APK that contains the victim's name and granting Accessibility permissions. The attackers then use remote control to take out loans. Next, they use WindRelay to relay real credit card NFC communication to the attacker's device in real-time, allowing them to make purchases at a legitimate POS terminal.

3. Attack Flow

Device Compromise and Loans

  1. An attacker calls the victim and pretends to be a bank employee.
  2. The attacker tricks the victim into sideloading a SpyNote APK that includes the victim's name.
  3. The attacker makes the victim enable Android Accessibility Service permissions.
  4. The attackers use SpyNote's remote control features to silently install WindRelay. In public cases, this required no extra user action.
  5. The attacker remotely operates the official banking app to apply for a loan in the victim's name.

NFC Card Relay and Cash-Out

  1. Following instructions over the call, the victim taps their real credit card on their smartphone and enters their PIN.
  2. The victim's device runs WindRelay and acts as a card reader to capture NFC APDU commands.
  3. The device relays the live traffic, including transaction-specific authentication data, to the attacker's device.
  4. The attacker's device emulates the card and presents it to a legitimate POS terminal at a physical store.
  5. Fraudulent payments are completed while the physical card stays safely with the victim.

4. Attacker Position and Execution Location

  • Social engineering and remote control happen via phone calls and attacker C2 servers.
  • SpyNote and WindRelay run on the victim's Android device.
  • NFC relay reception and card emulation run on the attacker's device. Cash-out happens at physical stores with legitimate POS terminals.
  • Root permissions are not required. The attack relies mainly on Accessibility, sideloading, and NFC permissions.

5. View from Victims and Administrators

  • To the victim, it looks like bank support steps, identity verification, or a card check.
  • The APK includes the victim's name, and the user is guided during a phone call, making it look very trustworthy.
  • To the bank, the actions may look like normal operations from a normal device, official app, and real card in a short time.
  • MDM and EDR tools might detect unknown APKs, Accessibility permissions, inter-app installations, NFC usage, and screen or input operations.

6. Success and Failure Conditions

Success Conditions

  • The victim allows the installation of an APK from an unknown source and grants Accessibility permissions.
  • The Android device supports NFC, and the victim taps their card and enters their PIN.
  • SpyNote successfully controls the banking app remotely.
  • The NFC communication delay is within the payment limit, and the attacker can access a POS terminal.

Failure Conditions

  • Block unknown APKs, dangerous Accessibility usage, and inter-app installations.
  • The bank assesses risks for new loans during phone calls, device state changes, and NFC relay characteristics.
  • The user hangs up the phone and calls the official number back.
  • The user stops the process when asked to tap a card or enter a PIN by someone claiming to be support.

7. What Happens Upon Success

The attackers can remotely control the victim's device to take out loans, steal credentials and screen data, and install more APKs. When the NFC relay succeeds, they can complete in-store payments without stealing the card. In the reported case, the entire process took about 13 minutes from the start of the call.

8. Observable Logs

  • Email: Not the main path. They might send APK URLs via SMS or messages, but details in public cases are limited.
  • Proxy/SWG/DNS: APK download sites, SpyNote/WindRelay C2, and short-lived new domains or IP traffic.
  • Endpoint/EDR: Sideload installs, unknown signed APKs, enabled Accessibility, additional APK installations from SpyNote, screen capture/input, and NFC foreground services.
  • Identity/IdP: Mobile banking device registration, sessions, loan applications, authentication methods, and device risk status.
  • SaaS/Cloud: MDM/MAM non-compliance, Play Protect warnings, and app permission changes.
  • Network: Low-latency two-way NFC relay traffic, C2 communication, and payment authentication between the attacker's device and the POS.

9. Attack Success Stages

  • Contact Only: Impersonation call, receiving an APK URL.
  • User Action: Installing the APK, granting Accessibility permissions, tapping the card, entering the PIN.
  • Initial Execution: SpyNote starts and connects to C2.
  • Malware Success: WindRelay installed, remote screen and input control active.
  • Authentication & Transaction Breach: Loan application approved, NFC relay session active, POS approval.
  • Loss Confirmed: Loan funds transferred, fraudulent payment completed, cash converted by the attacker.

10. Investigation Playbook

  • Trigger: Loans or payments made during a phone call, unknown APK + Accessibility, remote device operation and POS transaction at the same time.
  • Initial Check: Correlate call times, phone numbers, SMS, APKs, permission grants, card taps, and transaction times.
  • Device: Preserve APKs, signatures, hashes, Package Installer logs, Accessibility settings, notification access, overlays, NFC usage, C2, and screen operation traces.
  • Authentication & Cloud: Check bank sessions, loan workflows, device fingerprints, transaction authentication, and POS locations.
  • Subsequent Actions: Check for additional accounts, transfer destinations, other cards, stolen contacts/SMS, and new device registrations.
  • Containment: Enable airplane mode or isolate network, block cards, revoke bank sessions and credentials, put loans and payments on hold, and factory reset the device.
  • Verdict Categories: Social Engineering / SpyNote Installed / Remote Control Confirmed / WindRelay Confirmed / Loan Fraud / NFC Relay Transaction.

11. Defense and Detection Ideas

  • Single Events: Accessibility permissions right after a sideload, unknown APK installing another APK, NFC services used while banking.
  • Timeline Correlation: Incoming call -> APK installation -> Accessibility enabled -> Banking loan -> Card tap -> Remote POS payment.
  • Threat Hunting: APKs containing victim names, SpyNote permission sets, unknown Accessibility services, NFC relay services, and clusters of C2 IPs.
  • Log Gaps: Personal devices often lack MDM, app, Accessibility, and NFC logs. Bank transaction timelines serve as main evidence.
  • Top Priorities: Block unknown APKs, detect Accessibility abuse, identify risky devices within apps, require step-up authentication for high-risk transactions during calls, and detect card relay behavior.

12. Facts / Inference / Hypothesis

Facts

  • Group-IB identified about 20 related samples and 4 C2 IPs between November 2025 and July 2027.
  • Public cases targeted the Czech Republic, Slovakia, and Slovenia.
  • After SpyNote was installed, WindRelay was installed without extra user actions.
  • The phone calls lasted about 13 minutes.
  • No root privilege usage was confirmed in the public reports.

Inference

  • Similar vishing attacks targeting banks can be adapted for cryptocurrency and corporate banking app users, even if local APK sideload rates are low.
  • Without linking malware detection on devices to financial institution fraud detection, it is hard to see the full picture.

Hypothesis

  • Combining NFC round-trip latency, short-term remote POS usage with the same card, and transactions during phone calls can improve relay detection accuracy.

13. MITRE ATT&CK Mapping

  • High Confidence (Mobile): T1476 Deliver Malicious App via Other Means, T1456.002 GUI Input Capture, T1417 Input Capture, T1646 Exfiltration Over C2 Channel.
  • Medium Confidence: T1516 Input Injection, T1421 System Network Connections Discovery. NFC relay / HCE techniques do not have an exact match in existing ATT&CK Mobile and are treated as custom methods.

14. Unknowns and Further Investigation

  • Full APK hashes, C2 servers, package names, and signers.
  • Specific steps used to pass loan authentication and bypass bank checks.
  • WindRelay communication protocols, encryption, and latency management.
  • Expansion into Japanese-speaking regions or other Asian markets.

15. Impact on SOCs and Organizations

This type of attack requires joint investigations between corporate SOCs, financial SOCs, CSIRT, and Fraud departments. Organizations must manage Accessibility abuse and sideloading on BYOD and corporate Android devices. Financial institutions should prepare to correlate timelines for device risks, phone calls, loans, and NFC payments.

16. Summary by Role

  • For SOC Analysts: Correlate APKs, Accessibility, remote control, bank transactions, and POS approvals into a single timeline.
  • For IT Administrators: Restrict sideloading and dangerous Accessibility features. Control financial operations from non-compliant MDM devices.
  • For End Users: Bank staff will never ask you to install an APK, enable Accessibility, tap your card, or enter your PIN over the phone. Hang up and call the official number.

Top comments (0)