Contact Us At
Key Takeaway for Manufacturers, Wholesalers and Distributors
A newly documented Android malware campaign shows how criminals can combine a convincing phone call, malicious software, and NFC technology to relay payment-card transactions in real time. Businesses do not need to disable contactless payments, but they should make sure employees understand that a bank, card issuer, or support representative should never be trusted simply because a caller knows personal details or gives instructions that appear to solve an urgent account problem.
Short on time? Jump to the FAQ ↓
A phone call comes in from someone claiming to represent a bank. The caller already knows enough about the account holder to sound credible and explains that there is a problem with a payment card. To correct it, the customer is instructed to install an application, tap the physical card against the back of the Android phone, and enter a PIN.
The card never leaves the customer's hand. There is no suspicious card reader attached to an ATM, no cashier handling it out of sight, and no obvious transaction taking place nearby.
That apparent physical control over the card is what makes the attack persuasive.
Security researchers at Group-IB recently documented a malware family they named WindRelay, which works with the SpyNote Android remote-access trojan to turn a victim's phone into part of an NFC relay system. In the attack researchers described, the victim is persuaded to install malicious software outside the normal app-store process. Once the phone is compromised, the attacker can use it to communicate with the victim's physical contactless payment card and relay those communications over the Internet to a second device controlled by the criminal.
The result is not traditional card cloning in the familiar sense. The attacker does not necessarily need to create a permanent duplicate plastic card. Instead, the criminal can use the victim's card remotely while the card is communicating with the infected phone.
For a manufacturer, wholesaler, or distributor, the significance goes beyond a new piece of Android malware. The attack demonstrates how rapidly the line between cybersecurity and ordinary financial fraud is disappearing. An employee's phone, a company or personal payment card, a believable telephone call, and one bad decision can now become parts of the same attack.
HOW DOES WINDRELAY NFC RELAY MALWARE WORK?
WindRelay is an Android malware family designed to relay near-field communication, or NFC, between a victim's payment card and an attacker-controlled device. Group-IB reported that the malware was being used with SpyNote, a known Android remote-access trojan, in campaigns involving live social-engineering calls. Researchers identified activity associated with Czechia, Slovakia, and Slovenia, although NFC relay fraud more broadly has expanded into multiple countries and criminal ecosystems.
The attack is useful to examine because it depends on several controls failing in sequence.
First, the criminal gathers information about the intended victim. Group-IB reported that malicious applications were personalized with a victim's name, suggesting that attackers performed reconnaissance before making contact. That preparation makes the eventual telephone call more credible because the criminal is not approaching the victim as a complete stranger.
The attacker then calls while impersonating a bank representative and creates a reason for immediate action. The victim is instructed to install an Android application from outside the normal app-store process. That application contains SpyNote, which can obtain powerful permissions on the device and give the attacker remote capabilities.
Once SpyNote is active, Group-IB found that it can install and activate the WindRelay component. The victim is then persuaded to tap a contactless payment card against the phone—perhaps under the pretense of verifying the card, changing a PIN, or resolving a supposed security problem.
At that point, NFC communications from the physical card can be relayed through the infected phone to the attacker's infrastructure and then to another attacker-controlled Android device near a payment terminal. The two devices effectively extend the short physical distance normally required for contactless communication across the Internet.
That is an important distinction. The attack undermines the assumption that physical possession of the card necessarily means physical proximity to the transaction.
Other NFC-relay operations examined by Group-IB show that this is not an isolated technical experiment. The company's broader research into "Ghost Tap" fraud documented dozens of malicious Android APK variants and at least $355,000 in illegitimate transactions associated with one point-of-sale vendor between November 2024 and August 2025.
WHY THE PHONE CALL MATTERS MORE THAN THE MALWARE
It would be easy to turn this into an article about NFC technology or Android security settings. That would miss the most useful lesson for a business.
WindRelay cannot accomplish much on a normal employee's phone unless the criminal first persuades someone to participate.
The victim has to believe the story strongly enough to install software that did not come through the ordinary app-store process. Depending on the device and Android protections in place, the user may encounter security warnings or need to allow additional permissions. The criminal then has to convince the victim that placing a physical bank card against the phone is a reasonable part of correcting the supposed account problem.
Those are not incidental details. They are the attack.
Google itself warns Android users that scammers commonly impersonate bank fraud departments, technical-support providers, and delivery companies while attempting to persuade people to install unverified applications. Google recommends contacting an organization through a verified telephone number or official website when there is doubt about a request.
That principle applies particularly well in a business environment.
An employee receiving an urgent call about a company purchasing card, travel card, fuel card, or another payment account should not use the caller's telephone number, link, application, or instructions to establish whether the call is legitimate. The verification process needs to be independent of the person making the request.
If the card issuer says there is suspicious activity, hang up and call the number printed on the card or use the issuer's established application or website. That introduces a small amount of friction into the process, but it breaks a critical part of this attack: the criminal's ability to control both the problem and the supposed solution.
WHY THIS MATTERS TO MANUFACTURERS, WHOLESALERS AND DISTRIBUTORS
Many industrial businesses have become heavily dependent on mobile devices without necessarily treating those devices as part of the same security discussion as PCs and servers.
Purchasing personnel may approve transactions from phones. Salespeople travel with company cards. Managers access email, Microsoft 365, ERP information, expense systems, and banking applications from mobile devices. Drivers, technicians, warehouse personnel, and field employees increasingly use smartphones for business processes that once occurred at a desk.
Some devices are owned and managed by the company. Others are personal phones used for business under a bring-your-own-device arrangement. In either case, the employee carrying the phone may also carry a corporate payment card.
That does not mean the WindRelay campaign specifically targeted manufacturing purchasing departments or corporate cards. The published research describes financial fraud against individual victims and should not be expanded beyond what the researchers observed.
The reason it belongs on a business-security agenda is that the attack technique crosses boundaries companies often manage separately.
IT manages the phone.
Finance manages the card.
Human Resources or management handles security awareness.
The bank manages the payment account.
The employee makes the decision when the call arrives.
An attacker does not care about those departmental distinctions.
If employees are authorized to use company payment cards or conduct financial business from mobile devices, mobile fraud belongs somewhere in the company's security process.
SHOULD BUSINESSES BAN ANDROID PHONES OR CONTACTLESS PAYMENTS?
No. The WindRelay research does not support the conclusion that Android itself or ordinary contactless payments should be avoided.
The attack depends on malicious software and social engineering, not simply on the existence of NFC.
Android's ability to install applications from sources outside Google Play can increase exposure when a user follows a scammer's instructions. At the same time, Google provides protections designed to detect potentially harmful applications. Google Play Protect scans applications, including apps installed from outside Google Play, and can warn users, disable malicious software, remove it, or block certain unverified applications that request sensitive permissions commonly associated with financial fraud.
Google is also introducing additional developer-verification protections intended to make it more difficult for anonymous developers to distribute malicious applications to certified Android devices. Those protections are beginning in selected countries in September 2026 rather than appearing universally on every Android device at once.
Businesses should therefore avoid reducing the problem to "Android is unsafe." The better question is whether employees have a legitimate business reason to install applications from unknown sources and whether company-controlled devices allow them to do so.
In many managed business environments, they do not need that ability.
A mobile-device-management policy can restrict software installation, enforce supported operating-system versions, separate business information from personal applications, and provide administrators with more visibility into company-owned mobile devices. The exact controls should match the organization's use of mobile technology rather than being imposed simply because one new malware family has appeared.
For personal devices, the business has less control. That makes employee behavior and clear financial procedures more important.
THE MOST IMPORTANT CONTROL MAY BE A VERY SIMPLE RULE
Security-awareness programs often become collections of warnings: do not click suspicious links, inspect email addresses, use strong passwords, watch for unusual attachments, and report phishing.
All of those have value, but financial scams benefit from one rule that is easier to remember:
When someone unexpectedly contacts you and asks you to move money, provide credentials, install software, or take action involving a payment card, verify the request through a separate trusted channel before doing anything.
The rule works against more than WindRelay.
It applies when someone claims to be a bank representative asking an employee to install an app. It applies when a caller claims to be an executive requesting an urgent wire transfer. It applies when a supplier apparently sends new banking instructions. It applies when "technical support" needs remote access to a computer and when a message claims an account must be rescued immediately.
The attack method changes. The attempt to take control of the verification process does not.
For manufacturers and distributors, this is particularly relevant because financial communications often involve multiple outside organizations. Vendors change banking information. freight companies send payment requests. employees travel. purchasing departments work with many suppliers. accounting teams manage repeated transactions with familiar partners.
Criminals benefit when a request looks almost normal.
MOBILE SECURITY SHOULD MATCH THE ROLE OF THE DEVICE
Businesses should also take a more deliberate look at what their employees are actually doing with mobile devices.
A phone used only for calls and company email presents one risk profile. A phone that also contains banking applications, authenticator apps, ERP access, expense-management software, corporate email, customer information, and the ability to approve financial transactions presents another.
That does not automatically require a major mobile-security project. It does justify knowing which mobile uses are important to the business and what would happen if one of those devices were compromised.
Company-owned Android devices should generally remain on supported operating-system versions, receive security updates, use appropriate screen locks, and retain protections such as Google Play Protect. Businesses should be cautious about rooting or modifying Android devices used for sensitive work because Google warns that modified operating systems may lose security protections and automatic security updates.
If an organization has employees who routinely use company payment cards, those employees should also understand that no legitimate fraud investigation becomes more trustworthy merely because the caller knows their name, their bank, or some information about an account.
Personal information has become too widely available for knowledge alone to establish identity.
WHAT SHOULD AN EMPLOYEE DO IF THIS HAPPENS?
If someone claiming to represent a bank or card issuer asks an employee to install an application, tap a physical payment card against a phone, disclose a PIN, or follow unusual security instructions, the employee should stop the interaction and contact the financial institution independently using a known telephone number, official application, or website.
If software has already been installed, the situation should be treated as a potentially compromised device rather than simply an unsuccessful scam call. For a company-owned phone, IT should be contacted promptly so the device can be evaluated. If a company payment card was involved, Finance or the appropriate card administrator should also contact the issuing institution and review recent transactions.
Speed matters in payment fraud. Once money or goods have been obtained, recovery becomes considerably more difficult. That makes quick internal reporting more useful than trying to determine personally whether a strange transaction or application is serious enough to mention.
Employees should know whom to contact before something happens.
A security procedure that depends on figuring out the reporting process during an active fraud attempt has already introduced unnecessary delay.
WINDRELAY IS A WARNING ABOUT HOW FRAUD IS CHANGING
The most interesting part of WindRelay is not that criminals found another use for NFC. It is that the entire attack takes advantage of legitimate functions.
The phone can install applications.
The phone can communicate through NFC.
The card supports contactless transactions.
Remote-access software can control devices.
A bank can legitimately call a customer about suspected fraud.
Individually, none of those facts is remarkable. The criminal succeeds by combining them in a sequence that makes an abnormal request look plausible.
That is increasingly how businesses should think about social engineering. The danger is not always a technically sophisticated attack that defeats every security control. Sometimes the technology works exactly as designed while the attacker persuades a person to use it in a way the designers never intended.
For manufacturers, wholesalers, and distributors, protecting against that kind of fraud requires both technology and process. Managed mobile devices can reduce opportunities to install malicious software. Security tools can detect some harmful applications. Financial institutions can identify suspicious transactions. Employees can be trained to recognize unusual requests.
None is perfect by itself.
What matters is making it difficult for one convincing telephone call to become an approved path through all of them.
Frequently Asked Questions About Android NFC Malware and Payment Fraud
Can Android malware clone a contactless credit or debit card?
WindRelay is more accurately described as NFC relay malware rather than conventional card-cloning malware. In the documented scheme, the victim's physical card communicates with an infected Android phone, and those NFC communications are relayed over the Internet to an attacker-controlled device near a payment terminal.
What is WindRelay malware?
WindRelay is Android malware identified by Group-IB that relays NFC communications from a payment card to an attacker-controlled device. Researchers observed it being deployed alongside the SpyNote Android remote-access trojan as part of live social-engineering and payment-fraud operations.
Does WindRelay affect all Android users?
No. Simply owning an Android phone does not result in a WindRelay infection. The documented attack involved victims being socially engineered into installing malicious software from outside normal app-store channels. The attacker then used the compromised device as part of the fraud.
How can businesses reduce the risk of Android payment-card malware?
Businesses can reduce exposure by keeping company devices supported and updated, maintaining Google Play Protect or equivalent mobile security protections, restricting unapproved application installation where appropriate, and teaching employees to verify unexpected financial or technical-support requests through an independent channel. Company-owned devices that perform sensitive functions may also warrant centralized mobile-device management.
What should an employee do if a caller asks them to install an app for a bank or card problem?
The employee should end the call and contact the bank or card issuer independently using a verified number, official application, or website. Google specifically warns that scammers may impersonate bank fraud departments or technical support while asking users to install unverified applications.
Data-Link Associates is an IT managed services provider specializing in cybersecurity, IT support and ERP systems for manufacturers, distributors and wholesalers. Our office is located in Sugar Grove, Illinois, and we manage manufacturing IT nationwide. At your service since 1983. Contact Angela Jamerson at ajamerson@datalinkmsp.com or (630) 406-8969.
