Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it “WindRelay.”
NFC (Near Field Communication) is wireless technology that allows devices such as smartphones, payment cards, and payment terminals to communicate when they’re very close together. So, instead of stealing your physical bank card, the attackers capture NFC activity on an infected mobile phone and relay it in real time to a criminal-controlled device held against a contactless payment terminal, or an ATM that supports contactless cash withdrawals.
The researchers describe a 13-minute call impersonating a bank, in which a victim was persuaded to install an Android app labelled with the bank’s name. That app was a remote access Trojan (RAT) called SpyNote. SpyNote gave the attacker remote control of the phone and enabled the quiet installation of a second app, WindRelay.
Read more…
Source: Malware Bytes Labs
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Ransomware groups grow revenue by almost 40% in Q1 2026
June 2, 2026
In the first quarter of the year, ransomware groups increased their revenue by almost 40%, compared to the same period last year. This is according to a new report from cybersecurity researchers Rapid7, who said the increase is partly due to a maturing cybercriminal industry. Rapid7 based its findings on its research telemetry, which showed that ...
- Password manager Dashlane says hackers stole some customers’ password vaults
June 2, 2026
Password manager maker Dashlane says hackers have obtained at least a dozen encrypted vaults used for storing customer passwords during a weekend cyberattack. The company said on its website that hackers brute-forced the company’s two-factor authentication system, granting the hackers access to about 20 customer accounts. By defeating its two-factor mechanism, the hackers were able to download a copy of ...
- Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor
June 2, 2026
Palo Alto Unit 42 are tracking an increasingly widespread malvertising campaign targeting macOS. This campaign appears to be the next stage of a previous campaign known as JSCoreRunner, which was first identified in August 2025. In recent months, the financially-motivated attackers behind these campaigns transitioned from delivering standard adware, to delivering adware with full backdoor ...
- Fake virus alerts are invading mobile games
June 2, 2026
Sometimes it happens. You’re happily playing a game on your phone or laptop when suddenly alarms pop up out of nowhere: “Your device is infected!” “Your iCloud is full!” “Your account is restricted for watching porn!” Some games can be played for free if you agree to watch ads, and in others you can get extra lives, perks, or ...
- Palo Alto VPN bug graduates from advisory to active exploitation
June 1, 2026
Palo Alto customers are being been told to patch yet another internet-facing security flaw after researchers caught attackers bypassing GlobalProtect authentication and gaining unauthorized VPN access. The flaw, tracked as CVE-2026-0257, affects PAN-OS deployments using GlobalProtect authentication override cookies under specific configurations. Read more… Source: The Register Sign up for the Cyber Security Review Newsletter The latest cyber security news and ...
- Grand Theft Auto V cheat service gets hacked, exposing thousands of gamers
June 1, 2026
Atlas Menu, a cheat service for popular online video game Grand Theft Auto V, has been hacked, according to data breach notification website Have I Been Pwned. The stolen data included users’ email addresses, usernames, scrambled passwords, IP addresses, and support tickets, according to Have I Been Pwned, which said almost 64,000 accounts were part of the ...