FlagThis — Daily Cybersecurity Intelligence Briefing

Android attackers are utilizing a dual-payload chain, combining the SpyNote Remote Access Trojan (RAT) with the WindRelay module to perform real-time Near Field Communication (NFC) relay attacks. Initial access is achieved via vishing and the sideloading of malicious APKs. Following deployment, SpyNote provides remote administrative control to install WindRelay, which intercepts contactless payment credentials through Host Card Emulation (HCE) manipulation or NFC stack hooking. These credentials are relayed via Command and Control (C2) infrastructure to remote attackers, enabling unauthorized physical transactions at POS terminals and ATMs. This chain bypasses proximity requirements and facilitates multi-factor authentication (MFA) bypass through concurrent SMS interception and Accessibility Service abuse.

Law enforcement agencies, led by the Rae Bareli Police and Uttar Pradesh's "Operation Vajra," have executed a coordinated crackdown on the financial infrastructure supporting regional cyber fraud syndicates. The operation targeted the "mule account" ecosystem, where illicitly obtained or fraudulently opened bank accounts are utilized to layer and launder stolen funds. By analyzing digital transaction logs, payment gateway trails, and mobile device forensics—specifically investigating recruitment via encrypted messaging apps like WhatsApp and Telegram—authorities have identified 1,240 mule accounts and frozen approximately ₹1.98 crore in assets. This action addresses the critical financial pipeline used by threat actors to obscure the movement of proceeds from cybercrime.