MEDIUMApt
Global

WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud

·Source: The Hacker News

Updated:

Executive Summary

A previously unseen Android near field communication (NFC) relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan (RAT) called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to capture live card data via NFC and transmit it to fraudsters in real time. It was first detected in

Analysis

A previously unseen Android near field communication (NFC) relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan (RAT) called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to capture live card data via NFC and transmit it to fraudsters in real time. It was first detected in
Source Attribution

Originally published by The Hacker News on Aug 13, 2026.

Related Threats

MEDIUMApt

Africa’s Cybersecurity Challenge Is Bigger Than Access to Technology

Gopan Sivasankaran is Rapid7's Regional Director, Middle East & Africa. Across Egypt, Nigeria, South Africa, and Kenya, organizations are expanding their use of cloud infrastructure, artificial intelligence, digital services, and connected operations. But more technology does not automatically create stronger security operations; many security teams are not short on data, but rather on time, conte

Rapid7
MEDIUMApt

Russia Targeting Ukraine Using Internet-Connected Cameras

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/russia-targeting-ukraine-using-internet-connected-cameras-image_small-7-a-32566.jpg" align=right hspace=4><b>Attacks Against Ukrainian Soldiers and Materiel Tied to Hacking of European Devices</b><br>Hacked websites and internet-connected devices in Europe are serving as cyberespionage launchpads for Russia's ongoing war against U

Bank Info Security
MEDIUMApt

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Securelist (Kaspersky)