Android malware and NFC relay fraud campaigns

Security researchers have identified sophisticated Android malware campaigns targeting users through social engineering and remote access tools.

Initial findings detailed a scheme involving the SpyNote remote access trojan (RAT) and WindRelay, a specialized NFC malware. In this campaign, attackers use vishing—posing as bank employees—to trick victims in Eastern European countries, such as the Czech Republic, Slovakia, and Slovenia, into sideloading a malicious APK. Once Accessibility Service permissions are granted, attackers can control banking apps to apply for loans or execute NFC relay attacks. These attacks allow criminals to capture real-time NFC communication when a victim taps their physical credit card against the compromised phone, enabling unauthorized purchases at point-of-sale terminals.

Subsequent reports expanded on these threats, identifying additional malware and distribution methods. A second campaign involving the StreamRat malware spreads via paid advertisements on social media platforms like Facebook, Instagram, and TikTok, often promising free streaming services. This campaign has reportedly reached approximately 570,000 users. Additionally, the WindTapper group continues to utilize phone scams and WindRelay malware to facilitate real-time unauthorized contactless payments.