started · updated
Android NFC attacks increase by 188% due to WindRelay malware
Cybersecurity researchers have identified a significant surge in NFC-based attacks targeting Android users. Kaspersky reported 35,600 prevented NFC attacks in the first four months of 2026, marking a 188 percent increase compared to the previous year.
A primary threat is the WindRelay malware, identified by Group-IB. This malware is designed to intercept real-time NFC communication between a physical bank card and a smartphone, forwarding the data to external servers to facilitate unauthorized payments or data theft.
The infection process typically involves social engineering, where attackers contact victims via phone calls or messaging services to persuade them to install SpyNote spyware. Once SpyNote is active, WindRelay is installed. VirusTotal has tracked 23 variants of this malware between November 2025 and July 2026.
Entities
Android · Group-IB · Kaspersky · VirusTotal · WindRelay
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 2 SOURCES] Attackers use social engineering via phone calls or messaging services to trick users into installing SpyNote spyware. www.ad-hoc-news.de
- [○ 1 SOURCE] Kaspersky recorded 35,600 prevented NFC attacks globally during the first four months of 2026.
- [● 2 SOURCES] The WindRelay malware can intercept and forward real-time NFC communication from physical bank cards to external servers. www.ad-hoc-news.de
- [○ 1 SOURCE] VirusTotal recorded 23 variants of the WindRelay malware between November 2025 and July 2026.
- [○ 1 SOURCE] NFC-based attacks increased by 188 percent compared to the previous year.