SpyNote and WindRelay: Advanced Android NFC Relay and Device Takeover Framework
Android attackers are utilizing a dual-payload chain, combining the SpyNote Remote Access Trojan (RAT) with the WindRelay module to perform real-time Near Field Communication (NFC) relay attacks. Initial access is achieved via vishing and the sideloading of malicious APKs. Following deployment, SpyNote provides remote administrative control to install WindRelay, which intercepts contactless payment credentials through Host Card Emulation (HCE) manipulation or NFC stack hooking. These credentials are relayed via Command and Control (C2) infrastructure to remote attackers, enabling unauthorized physical transactions at POS terminals and ATMs. This chain bypasses proximity requirements and facilitates multi-factor authentication (MFA) bypass through concurrent SMS interception and Accessibility Service abuse.