WindRelay NFC Relay Malware Paired with SpyNote RAT: Real-Time Android Credit Card Theft — Detection and Response Guide

A newly documented Android malware campaign pairs two highly complementary payloads: WindRelay, an NFC relay implant that captures and forwards live contactless card data to attackers in real time, and SpyNote, a well-established remote administration tool (RAT) that abuses Android Accessibility Services to take full control of the infected device. Together, they allow threat actors to do something that materially raises the stakes over classic banking trojans: relay a victim's physical payment card for fraudulent tap-to-pay transactions while simultaneously operating the device to take out loans in the victim's name through legitimate banking and fintech applications.

This is not a theoretical capability. NFC relay malware closes the distance gap in contactless fraud — the attacker no longer needs the physical card, just a victim willing to install a malicious APK and tap their card against the phone under some pretext. Combined with SpyNote's accessibility-driven device takeover, the attackers can harvest OTPs, approve transactions, and interact with lending apps while the victim watches what appears to be a normal screen. For defenders, fraud teams, and incident responders, this shifts the battleground: the initial access vector is social engineering and sideloaded APKs, and the observable artifacts live on mobile devices, in MDM telemetry, and in downstream financial transaction anomalies.

No CVE is associated with this campaign — it exploits Android's legitimate NFC and Accessibility feature set plus user trust, not a patchable vulnerability. That makes behavioral detection, mobile threat defense, and hardening policy the primary lines of defense.

Technical Analysis

The Malware Combo

WindRelay (NFC relay implant)

• Leverages Android's NFC host card emulation / reader-mode capabilities to capture contactless card exchanges when the victim is tricked into holding a payment card near the infected device.
• Relays the captured card data in real time to attacker-controlled infrastructure, where a second device (the "reader side") can present the card to a legitimate payment terminal — the classic NFC relay pattern, productized as malware.
• Requires NFC to be enabled and the malicious app to hold NFC permissions; distribution is via sideloaded APKs, typically delivered through smishing (SMS phishing), messaging apps, or fake banking/utility apps.

SpyNote (Android RAT)

• A mature RAT family known for aggressive abuse of Android Accessibility Services to achieve persistence, keylogging, screen capture, and automated UI interaction (clicking, approving prompts, reading OTPs).
• Requests Accessibility and Notification access under benign pretexts, then uses them to self-grant additional permissions and suppress uninstall attempts.
• In this campaign, SpyNote provides the interactive device-takeover channel: operating banking and lending apps, capturing session tokens and one-time passcodes, and completing fraudulent loan applications in the victim's identity.

Attack Chain (Defender's View)

1. Delivery: Victim receives a smishing link or message directing them to download an APK outside Google Play (fake bank app, "security update," delivery app, etc.).
2. Installation: Android requires the user to permit installs from unknown sources — the social engineering walks them through it.
3. Permission escalation: The app requests Accessibility Service access (SpyNote) and NFC permissions (WindRelay), framed as required for the app to function.
4. Card capture: Victim is instructed (e.g., during a fake "card verification" flow) to hold their contactless card against the phone; WindRelay relays the exchange to attacker infrastructure in real time for an immediate fraudulent tap-to-pay transaction.
5. Device takeover & financial fraud: SpyNote drives lending and banking apps via Accessibility automation — applying for loans, intercepting OTPs from notifications/SMS, and confirming transactions without visible UI change to the victim.
6. Persistence & concealment: Accessibility abuse hides the app icon, blocks uninstallation, and suppresses security warnings.

Exploitation Status

• Confirmed active in-the-wild campaign combining both families against Android users.
• No CVE, no CISA KEV entry — this is feature abuse (NFC, Accessibility Services, sideloading), which is precisely why patching cannot fix it.
• Affected platform: Android devices with NFC capability that permit sideloaded applications; enterprise risk concentrates on BYOD devices used for mobile banking or holding corporate credentials accessible from the device.

Why This Matters to Enterprise Defenders

Even though the immediate victims are consumers, the enterprise exposure is real: BYOD devices with corporate email/SSO sessions become SpyNote-controlled endpoints; fraudulent loans create direct financial harm and lengthy identity-recovery IR cases for staff; and the same smishing infrastructure is trivially repurposed against employees. Treat this as a mobile-device intrusion scenario in your IR playbooks, not a "consumer problem."

Detection & Response

The observables that matter: sideloaded APKs, Accessibility Service grants to non-system apps, anomalous DNS/proxy traffic from mobile segments, and mobile threat defense alerts naming SpyNote or NFC-relay behavior. The detections below target those chokepoints.

Sigma Rules

---
title: APK Sideload Download via Corporate Proxy
description: Detects Android APK package downloads from domains other than official app stores, a primary delivery vector for WindRelay/SpyNote droppers via smishing links opened on corporate networks or VPN.
references:
  - https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/
author: Security Arsenal
id: 3f8a1c52-7b6d-4e91-a2c4-9d5e7f0a1b23
status: experimental
date: 2026/01/20
logsource:
  category: proxy
detection:
  selection_uri:
    c-uri|endswith:
      - '.apk'
      - '.apk?'
  selection_scheme:
    scheme:
      - 'http'
      - 'https'
  filter_official_stores:
    c-uri|contains:
      - 'play.google.com'
      - 'dl.google.com'
      - 'samsungapps.com'
      - 'galaxystore'
      - 'amazon.com/appstore'
  condition: selection_uri and selection_scheme and not filter_official_stores
falsepositives:
  - Enterprise MDM sideloading of internal applications
  - Developer/QA testing of Android builds
level: high
---
title: Android Device DNS Query to Dynamic DNS Provider
description: Detects Android devices (identified by DHCP/user-agent or mobile subnet tagging in DNS logs) resolving dynamic DNS hostnames, a pattern consistent with SpyNote-family RAT C2 infrastructure that historically favors no-cost DDNS for resilience.
references:
  - https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/
author: Security Arsenal
id: 8c2e5b14-4f7a-4d38-b6e1-2a9c3d7f5e08
status: experimental
date: 2026/01/20
logsource:
  category: dns
detection:
  selection:
    query|endswith:
      - '.ddns.net'
      - '.no-ip.com'
      - '.no-ip.org'
      - '.duckdns.org'
      - '.hopto.org'
      - '.zapto.org'
      - '.sytes.net'
      - '.servehttp.com'
      - '.myftp.org'
      - '.bounceme.net'
      - '.redirectme.net'
  filter_common_use:
    query|contains:
      - 'printer'
      - 'nas'
      - 'camera'
      - 'dvr'
  condition: selection and not filter_common_use
falsepositives:
  - Legitimate IoT and home-office equipment using DDNS (tune by asset inventory)
  - Remote-access tools sanctioned by IT
level: medium

KQL — Microsoft Sentinel / Defender

The following hunts assume Microsoft Defender for Endpoint (or another MTD) is deployed to Android devices, and/or that mobile traffic traverses monitored DNS/proxy infrastructure.

// Hunt 1: MTD/MDE alerts on Android devices referencing SpyNote, NFC relay, or banking-trojan behavior
AlertEvidence
| where TimeGenerated > ago(14d)
| where DeviceType =~ "Android" or FileName endswith ".apk"
| join kind=inner (
    AlertInfo
    | where TimeGenerated > ago(14d)
    | where Title has_any ("SpyNote", "WindRelay", "NFC", "relay", "banking", "Rat", "Spyware")
) on AlertId
| project TimeGenerated, Title, Severity, Category, DeviceName, DeviceType, FileName, SHA256, FolderPath, RemoteUrl, RemoteIP
| sort by TimeGenerated desc
;
// Hunt 2: Android devices communicating with dynamic DNS domains or rare external endpoints
let DdnsProviders = dynamic(["ddns.net","no-ip.com","no-ip.org","duckdns.org","hopto.org","zapto.org","sytes.net","servehttp.com","bounceme.net"]);
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where DeviceType =~ "Android"
| where RemoteUrl has_any (DdnsProviders) or (RemoteIPType == "Public" and ActionType == "ConnectionSuccess")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    Ports = make_set(RemotePort), URLs = make_set(RemoteUrl)
    by DeviceName, RemoteIP, InitiatingProcessFileName
| where ConnectionCount > 50 or array_length(URLs) > 0
| sort by ConnectionCount desc
;
// Hunt 3: Proxy/DNS visibility for APK sideload attempts (CommonSecurityLog via CEF-ingested proxy/firewall)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL endswith ".apk" or FileName endswith ".apk"
| where RequestURL !has_any ("play.google.com", "dl.google.com", "samsungapps.com")
| summarize DownloadCount = count(), Sources = make_set(SourceIP), Destinations = make_set(DestinationHostName)
    by RequestURL, FileName
| sort by DownloadCount desc

Velociraptor VQL

Velociraptor does not run on Android, but it is valuable on the managed Windows/macOS fleet for two adjacent observables: APK files downloaded to corporate endpoints (smishing links opened on desktop, or droppers staged for later transfer to a phone), and browser download artifacts showing the phishing origin.

-- Hunt for Android APK artifacts staged on managed endpoints (smishing/dropper staging)
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=[
    'C:/Users/*/Downloads/*.apk',
    'C:/Users/*/Desktop/*.apk',
    'C:/Users/*/Documents/*.apk',
    '/Users/*/Downloads/*.apk'
])
WHERE Mtime > timestamp(epoch=now() - 1209600)
ORDER BY Mtime DESC

-- Correlate with recent browser download history for phishing-origin URLs (Chrome/Edge)
SELECT FullPath, Size, Mtime
FROM glob(globs=[
    'C:/Users/*/Downloads/*.apk',
    'C:/Users/*/Downloads/*.crdownload'
])
ORDER BY Mtime DESC

Android Device Audit — Bash (via ADB)

For incident response on a suspect Android device (corporate-issued or a consenting BYOD user), the following ADB-based audit script enumerates the exact artifacts WindRelay/SpyNote depend on: sideloaded packages, Accessibility Service grants, NFC permission holders, and Play Protect state. Run it against a USB-connected device with debugging authorized, or adapt the commands into your MDM's remote-shell capability.

#!/bin/bash
# Security Arsenal - Android SpyNote/WindRelay IR Audit
# Prerequisites: device connected via ADB, USB debugging authorized
set -euo pipefail
SERIAL="${1:-}"
ADB="adb ${SERIAL:+-s $SERIAL}"
REPORT="android_audit_$(date +%Y%m%d_%H%M%S).txt"

{
echo "=== Device Identity ==="
$ADB shell getprop ro.product.model
$ADB shell getprop ro.build.version.release

# All third-party (sideloaded) packages - SpyNote/WindRelay live here
echo "=== Third-Party Packages ==="
$ADB shell pm list packages -3

# Install source per package: anything NOT com.android.vending / com.sec.android.app.samsungapps is suspicious
echo "=== Install Sources ==="
for pkg in $($ADB shell pm list packages -3 | sed 's/package://' | tr -d '\r'); do
  src=$($ADB shell pm get-install-location "$pkg" 2>/dev/null | tr -d '\r')
  installer=$($ADB shell cmd package get-installer-package-name "$pkg" 2>/dev/null | tr -d '\r')
  echo "$pkg -> installer: ${installer:-unknown}"
done

# Enabled Accessibility Services - SpyNote's primary control channel
echo "=== Enabled Accessibility Services ==="
$ADB shell settings get secure enabled_accessibility_services

# Apps holding NFC permissions - WindRelay prerequisite
echo "=== Packages with NFC Permissions ==="
$ADB shell pm list packages -3 -g | tr -d '\r' | while read -r line; do
  pkg=$(echo "$line" | sed 's/package://' | cut -d' ' -f1)
  if $ADB shell dumpsys package "$pkg" 2>/dev/null | grep -q "android.permission.NFC"; then
    echo "NFC: $pkg"
  fi
done

# Unknown-sources install setting state
echo "=== Unknown Sources / Install Unknown Apps ==="
$ADB shell settings get secure install_non_market_apps
$ADB shell appops query-op REQUEST_INSTALL_PACKAGES 2>/dev/null || true

# Device admin receivers (persistence)
echo "=== Active Device Admins ==="
$ADB shell dumpsys device_policy | grep -A2 "Active admin" || true

# Screen overlay / notification listeners (credential theft channels)
echo "=== Notification Listeners ==="
$ADB shell settings get secure enabled_notification_listeners
} | tee "$REPORT"

echo "[+] Audit written to $REPORT"

Remediation

There is no patch — the remediation is removal, financial containment, and policy hardening.

For Infected Devices (IR Steps)

1. Isolate the device immediately. Enable airplane mode (do NOT power off if you intend to preserve volatile evidence for forensics first — capture the ADB audit above before wiping).
2. Financial containment first, forensics second in parallel. Contact the issuing bank(s) to freeze/replace every payment card that was near the device, and dispute any tap-to-pay transactions the cardholder did not perform. Check credit reports and banking/lending apps for fraudulent loan applications; place fraud alerts or credit freezes with the relevant bureaus (Equifax, Experian, TransUnion in the US).
3. Change credentials from a known-clean device — banking, email, and any account whose OTPs traversed the infected phone (SpyNote reads notifications and SMS).
4. Remove the malware. Accessibility-abusing RATs actively resist uninstallation. If the app cannot be removed in normal mode, boot into Safe Mode (which disables third-party Accessibility Services) and uninstall, or revoke the device-admin/accessibility grant first via Settings > Security > Device admin apps and Settings > Accessibility. For confirmed SpyNote infections, a factory reset is the recommended end state — the RAT's persistence depth makes partial cleanup unreliable.
5. Reset corporate sessions. If the device held corporate email, VPN, or SSO sessions, revoke refresh tokens, force re-authentication, and review conditional-access sign-in logs for session reuse from anomalous IPs.

For Organizations (Preventive Hardening)

• Block sideloading via MDM. On corporate and COPE/BYOD-with-work-profile Android devices, enforce install_unknown_sources restrictions and disallow installs from outside Google Play / managed Play Store. In Android Enterprise, disable unknown sources at the device or work-profile level.
• Deploy Mobile Threat Defense. MTD tooling (Microsoft Defender for Endpoint on Android, Lookout, Zimperium, etc.) has behavioral detection for SpyNote-class RATs and flags Accessibility Service abuse — the single highest-fidelity signal in this campaign.
• Audit Accessibility grants. Continuously inventory which apps hold Accessibility Service access on managed devices. Legitimate holders are a short, known list (password managers, MDM agents, accessibility tools). Anything else is a hunt lead.
• User awareness targeting the lures. Train users that no bank, delivery service, or government agency will ever ask them to install an app from a link, grant Accessibility access, or hold a payment card against their phone to "verify" it. That last behavior is the WindRelay kill shot — it only works if the victim taps the card.
• Monitor financial-fraud signals. Coordinate with your fraud/finance teams: an employee reporting an unexpected loan inquiry or card-present-style transaction they didn't make is an IR trigger, not just a bank problem.
• Smishing-resistant controls. Enable carrier/endpoint SMS filtering where available, and treat inbound links to APK downloads on your proxy/DNS telemetry as high-severity alerts (detections above).

Vendor & Official References

• BleepingComputer coverage: https://www.bleepingcomputer.com/news/security/android-malware-combo-takes-out-loans-and-relays-victims-credit-cards/
• Android Enterprise — controlling unknown-sources installs: https://support.google.com/work/android/answer/6430921
• Google Play Protect guidance: https://support.google.com/googleplay/answer/2812764

Key Takeaways

• WindRelay + SpyNote is a division-of-labor kill chain: one payload monetizes the physical card via NFC relay, the other monetizes the identity via Accessibility-driven device takeover and fraudulent loans.
• There is no vulnerability to patch — the attack abuses sideloading, NFC, and Accessibility Services as designed. Detection must be behavioral: sideloaded APKs, Accessibility grants, DDNS C2, and MTD alerts.
• The victim's own action — tapping a card against the phone — is the enabling step. User education is a control here, not an afterthought.
• For responders: financial containment (card replacement, credit freeze) runs in parallel with device forensics, and confirmed SpyNote infections warrant factory reset rather than attempted surgical removal.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub