A new Android malware campaign turns victims' own phones into point-of-sale terminals, letting attackers charge contactless cards the moment they're tapped against the screen.
Security firm Group-IB is tracking the campaign, dubbed WindRelay, across Czechia, Slovakia, and Slovenia. Attackers research a target, then call pretending to be their bank and talk them into sideloading a remote access trojan called SpyNote, personalized with the victim's own name to lower their guard. Once SpyNote is running, the attackers remotely install a second piece of malware, WindRelay itself, which captures near-field-communication data in real time. When the victim taps their card against the infected phone as instructed, the payment details go straight to the attacker's own terminal.
Calls average 13 minutes, and Group-IB found 23 samples uploaded to VirusTotal between November 2025 and July 2026 - a small, tightly targeted operation rather than a mass campaign. That precision is the real story: this is a bespoke build-per-victim pipeline, not spray-and-pray phishing, and in at least one case the attackers used their access to take out a loan in the victim's name, turning a card-cloning scam into a longer-term debt problem.
Vishing-plus-malware combos are old news - groups like ShinyHunters have run similar plays for years - but those crews typically hang up once a victim logs into a fake portal. WindRelay's operators stay on the line for the full 13 minutes, patiently walking a target through installing two separate pieces of malware and tapping a physical card against it.