As reported by BleepingComputer, a sophisticated two-malware combination targeting Android devices is enabling attackers to simultaneously drain credit cards via NFC relay and take out fraudulent loans — all while victims remain completely unaware. This campaign represents a meaningful escalation in mobile financial fraud tradecraft, and it deserves serious attention from security teams, financial institutions, and consumers alike.

Threat Alert: As reported by BleepingComputer, a sophisticated two-malware combination targeting Android devices is enabling attackers to simultaneously drain credit cards via NFC relay and take out fraudulent loans — all while victims remain completely unaware.

Why This Threat Is Different

Most mobile malware operates on a single attack vector — credential theft, SMS interception, or banking overlay screens. What makes the WindRelay and SpyNote combination particularly dangerous is its layered, real-time exploitation model. SpyNote provides full remote access to the infected device, giving attackers the ability to observe, interact with, and control the victim's phone as if they were holding it. WindRelay then weaponizes the device's NFC hardware to relay contactless payment card data to attacker-controlled hardware at a point-of-sale terminal anywhere in the world.

This isn't theoretical — NFC relay attacks have been demonstrated in academic research for years, but pairing them with a live RAT that can dynamically respond to authentication challenges represents a practical, deployable threat at scale. The attacker isn't just passively stealing stored data; they're operating through the victim's device in real time.

Who Is Most at Risk

Why This Threat Is Different
Android users who sideload applications — both SpyNote and NFC relay tools are typically distributed outside the Google Play Store via phishing links, fake app stores, or social engineering campaigns.
Users in regions with high contactless payment adoption — where tap-to-pay infrastructure is ubiquitous, stolen NFC data has immediate, frictionless utility.
Victims targeted for loan fraud — attackers with full RAT access can navigate banking apps, complete identity verification steps, and submit loan applications using the victim's real credentials, making this a multi-stage financial crime.
Financial institutions and fintechs — particularly those relying on device-based biometrics or in-app authentication without behavioral anomaly detection.

The Broader Threat Landscape Context

This campaign is not an isolated incident. The security community has watched NFC-based attack tooling mature steadily since proof-of-concept tools like NFCGate emerged from academic research. The commoditization of RAT capabilities through tools like SpyNote — which has been sold and leaked across criminal forums — means the barrier to entry for this attack class is falling rapidly. Criminal operators no longer need deep technical expertise to combine these tools into an effective campaign.

When a RAT and an NFC relay tool are used in tandem, attackers gain the ability to commit fraud that appears, to every authentication system in the chain, to originate from the legitimate account holder's own device. That's an extremely difficult signal to catch.

Financial fraud teams should also note that the loan application component of this campaign is particularly insidious. Fraudulent loan applications completed through a victim's own authenticated banking session may pass identity verification, behavioral biometrics, and device fingerprinting checks — all of which are calibrated to detect anomalies from unfamiliar devices, not the victim's own phone under attacker control.

Shield53 Recommendations

For Individual Users

  • Only install applications from the Google Play Store; never sideload APKs from unverified sources, regardless of how convincing the distribution method appears.
  • Regularly audit app permissions — SpyNote requires extensive permissions (accessibility services, camera, microphone, SMS). Review and revoke any suspicious grants immediately.
  • Enable Google Play Protect and ensure it is running active device scans.
  • Disable NFC when not actively using contactless payments. This is a simple, high-value friction step that breaks the relay chain.
  • Monitor bank and credit accounts daily for unfamiliar transactions or loan inquiries — early detection is critical given how quickly funds can be moved.

For Financial Institutions and Fintechs

  • Implement behavioral anomaly detection that flags unusual loan applications or large transactions occurring outside normal usage patterns, even from authenticated sessions on known devices.
  • Introduce friction for high-value actions (loan applications, large transfers) that requires out-of-band confirmation — a separate channel that a RAT cannot easily intercept.
  • Correlate NFC transaction geography with device GPS and IP data in real time. A contactless payment appearing in one country while the device is geolocated in another is a high-confidence fraud signal.
  • Share threat intelligence on SpyNote and WindRelay indicators of compromise (IOCs) across your fraud operations and SOC teams.

For Enterprise Security Teams

  • Enforce Mobile Device Management (MDM) policies that restrict sideloading on corporate and BYOD devices with access to sensitive applications.
  • Add SpyNote and WindRelay IOCs to your mobile threat defense (MTD) platform signature sets immediately.
  • Educate employees about social engineering delivery vectors commonly used to distribute these tools, including fake utility apps, customer service impersonation, and phishing via SMS (smishing).

The convergence of remote access capabilities and hardware-level payment relay marks a new chapter in mobile financial fraud. Security teams who treat this as a niche consumer problem will find themselves underprepared when enterprise-adjacent devices — including those used for mobile banking, expense management, or corporate travel — become targets.