WindRelay and SpyNote Malware Enable NFC Relay Fraud Scheme

A new malware combination, WindRelay and SpyNote RAT, has emerged, facilitating NFC relay fraud through social engineering. This attack allows criminals to access victims' banking apps and payment cards in a single session. The European Payments Council reported a significant rise in NFC relay fraud, with a 188% increase in attacks on Android devices in early 2026 compared to the previous year. Law enforcement has noted the spread of these attacks, particularly in Central and Eastern Europe, with over 35,600 attacks blocked in the first four months of 2026. The malware exploits vulnerabilities in contactless payment systems, leading to unauthorized transactions and potential money laundering. The first documented attacks began in late 2023 in the Czech Republic, with subsequent arrests. The scale of the fraud is underscored by the identification of over 70 command-and-control servers linked to these campaigns.

Key Points: • WindRelay malware combined with SpyNote RAT enables NFC relay fraud. • NFC relay attacks on Android devices surged by 188% in early 2026. • Over 35,600 NFC-based attacks were blocked in the first four months of 2026.