Group-IB researchers Alexander Grabko, Konstantinos Angelopoulos, Pavlos Gaitanis and Bruno Bijelić have documented WindRelay, Android malware that turns a victim's phone into one half of a live payment-card relay.
The technique is known as Ghost Tap. What makes this write-up worth reading is the last step of the social engineering.
How the relay works
Two components, synchronised over shared command-and-control infrastructure via WebSocket:
The reader runs on the victim's phone. It talks to a physical payment card over NFC.
The emulator runs on the attacker's device, at a real payment terminal, pretending to be that card.
Between them they relay EMV APDU commands and responses in real time. The terminal believes it is talking to the card. The card believes it is talking to a terminal. Both are right; they are just several hundred miles apart.
The attacker never touches the card and never appears on the terminal's records as anything other than a normal contactless payment.
The infection chain, and the part that stands out
- Phishing, smishing or vishing lures the target into sideloading an APK
- The APK is personalised with the victim's name — meaning reconnaissance happened before the call
- SpyNote RAT provides remote access
- The fraudsters use SpyNote's Accessibility Service to silently install and activate the NFC malware — no user interaction
- The victim is then socially engineered into tapping their physical card against their own infected phone
Step five is the one to sit with.
Every instinct about card fraud assumes the card has to leave your control, or its details have to be stolen. Here the card never leaves the victim's hand, no card number is exfiltrated, and the fraudulent purchase happens in a shop the victim has never been to — because the victim performed the authenticating action themselves, on their own device, while being told it was something else.
The Accessibility Service abuse in step four is the same permission class that made PROMPTSPY able to navigate an Android UI autonomously. Once granted, it is the most powerful thing on the phone.
Scale and targeting
23 samples, impersonating financial institutions in Czechia, Slovakia and Slovenia.
First detected late August 2025; samples analysed from November 2025 through July 2026. So this has been running for roughly a year in a specific region.
Group-IB does not publish theft figures, and neither will we.
Two ways to monetise one infection
The report's framing is worth quoting in substance: the RAT-driven remote access can be used to take out a digital loan, while the NFC malware enables physical, card-present purchases.
One compromise, two channels — one that drains credit the victim did not know they had, one that spends at a till. Card-present transactions also carry weaker fraud protections for the customer in many markets than card-not-present ones do, precisely because a physical tap has historically been strong evidence the cardholder was there.
Here it is evidence of nothing.
What protects people
- Never sideload an APK, whatever the reason given. This is the whole chain's foundation and the only step that is entirely in the user's control.
- Treat any request to tap your card against your phone as fraud. There is no legitimate support process that needs this. This is the single most useful sentence to pass on to anyone non-technical.
- Check what has Accessibility Service permission — Settings → Accessibility. Anything there can see and control everything on screen.
- A personalised approach is not proof of legitimacy. The APK carrying your name means they did homework, not that they are your bank.
- Turn NFC off when not using it, on a phone you have any doubts about.
For banks: a contactless transaction relayed this way looks like a normal card-present tap. The detectable signals are behavioural — geography against the customer's phone, terminal patterns, velocity — not anything in the transaction itself.
