News · Case study · 1 week ago
Android Malware Turns Phones Into Card Skimmers
A new Android malware campaign shows how banking fraud is evolving from stealing passwords and OTPs into real-time manipulation of smartphones, payment cards and victims themselves. By combining remote-access malware with NFC relay technology, attackers can potentially turn a victim’s own phone into a bridge for fraudulent transactions.
Researchers at Group-IB identified the NFC relay malware WindRelay, which captures contactless card communication and forwards it in real time to an attacker-controlled device. This could allow criminals elsewhere to attempt payments or withdrawals without physically possessing the victim’s card.
Social Engineering Starts the Attack
The attack begins with bank impersonation. In the case described by researchers, criminals spent around 13 minutes on a phone call convincing the victim to install an application appearing to belong to the bank. The application was actually SpyNote, a remote-access Trojan that provided control over the Android device.
Attackers subsequently installed WindRelay and used their access to interact with the victim’s legitimate banking application, including initiating a loan application. The victim was then instructed to tap a physical payment card against the compromised smartphone and enter the PIN.
At that moment, WindRelay captured the NFC exchange and transmitted it to the attacker.
Why the Attack Happens in Real Time
Modern contactless cards use dynamic cryptographic values for transactions, making simple copying and later replay of card data more difficult. WindRelay instead acts as a real-time relay, extending the live interaction between the genuine card and an attacker-controlled device.
The malware combination is particularly powerful: SpyNote controls the phone, while WindRelay relays the card interaction.
The human victim also becomes part of the attack chain. Criminals stay on the call, building trust and directing each step from installing the malicious application to tapping the card and entering the PIN.
Banking Fraud Becomes a Multi-Layer Attack
WindRelay represents an evolution of NFC relay or “ghost tapping” attacks associated with earlier malware such as NGate and SuperCard X. The broader trend is significant because attackers are combining social engineering + malware + remote device control + legitimate banking applications + live payment infrastructure.
This means banks increasingly need to assess more than whether the correct credentials or card were used. Device integrity, behavioral anomalies, transaction context and signs of remote control can all become important fraud signals.
Where FaceOff Sovereign AI Could Add Protection
FaceOff Technologies could position its Sovereign AI Trust Layer as an additional defensive capability around the banking interaction not as a replacement for endpoint security or payment-network controls.
With appropriate permissions and integration, FaceOff could potentially analyze voice authenticity, conversational risk signals and behavioral/contextual anomalies during high-risk interactions. A newly sideloaded application, active remote-access session, unusual banking workflow or unexpected card-tap instruction could contribute to an elevated risk assessment.
The proposed architecture could be:
Banking Call → Voice/Liveness Verification → Behavioral & Contextual Analysis → Device Trust → Transaction Risk → Alert / Step-Up Verification / Block
For example, if a high-value banking action coincides with suspicious device conditions and an unusual interaction pattern, the system could trigger stronger verification or human review before the transaction proceeds.
Importantly, behavioral or voice analysis should be treated as risk signals rather than proof of fraud, with final decisions based on multiple signals and established banking controls.
Analysis: Trust Must Become Continuous
The WindRelay attack demonstrates why authentication at login is no longer sufficient. A customer may be genuine, the banking application legitimate and the payment card authentic—yet an attacker can still manipulate the interaction surrounding all three.
The next generation of banking security therefore needs to move from “Who logged in?” to “Is this entire interaction trustworthy?”
That is where sovereign, multimodal AI could become valuable: continuously combining identity, voice, behavior, device and transaction context while keeping sensitive data within controlled infrastructure.