A new malware strain exploiting NFC functionality to transmit victims' contactless card data in real-time to fake payment terminals has been detected. When combined with a remote access trojan (RAT), it performs simultaneous digital and physical financial theft within a single call session, classifying it as a new threat type distinct from existing NFC relay attacks.

According to an actual attack case documented by Group-IB's fraud prevention team, fraudsters induced victims to install SpyNote RAT during phone calls impersonating bank employees.

After obtaining remote access privileges, they covertly installed WindRelay on the victim's device, then simultaneously proceeded with a loan application in the victim's name and real-time relay of card NFC data within the same 13-minute call.

When the victim tapped their card once and entered their PIN, the stolen data was transmitted to a remote fake terminal, resulting in cash withdrawals.

Between November 2025 and July 2026, associations were confirmed between 23 malicious samples uploaded to VirusTotal and 4 command-and-control (C&C) servers in Czechia, Slovakia, and Slovenia.

According to independent telemetry data, NFC-based attacks targeting Android devices increased 188% year-over-year from January to April 2026.

Specifically, it stated recommendations include △strengthening monitoring of RAT indicators such as sideloaded apps and accessibility service exploitation installed during calls, rather than relying solely on screen sharing detection △setting external app installations outside official app markets as independent risk signals △implementing correlation analysis between loan disbursements and concurrent card face-to-face transactions.