Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it “WindRelay.”
NFC (Near Field Communication) is wireless technology that allows devices such as smartphones, payment cards, and payment terminals to communicate when they’re very close together. So, instead of stealing your physical bank card, the attackers capture NFC activity on an infected mobile phone and relay it in real time to a criminal-controlled device held against a contactless payment terminal, or an ATM that supports contactless cash withdrawals.
The researchers describe a 13-minute call impersonating a bank, in which a victim was persuaded to install an Android app labelled with the bank’s name. That app was a remote access Trojan (RAT) called SpyNote. SpyNote gave the attacker remote control of the phone and enabled the quiet installation of a second app, WindRelay.
Read more…
Source: Malware Bytes Labs
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Swedish transport agencies targeted in cyber attack
October 12, 2017
Swedish transport authorities were hit by a cyber attack on Thursday morning, a day after trains were delayed as a result of another attack on IT systems monitoring railway traffic. The website of Sweden’s Transport Agency (Transportstyrelsen) was partially down on Thursday morning, according to the agency most likely as a result of a DDoS attack. During ...
- Cyber-security threat to UK ‘as serious as terrorism’ – GCHQ
October 9, 2017
Keeping the UK safe from cyber-attacks is now as important as fighting terrorism, the head of the intelligence monitoring service GCHQ has said. Jeremy Fleming said increased funding for GCHQ was being spent on making it a “cyber-organisation” as much as an intelligence and counter-terrorism one. It comes after the NHS and parliament suffered cyber-attacks this year. Mr ...
- Disqus Hacked: More than 17.5 Million Users’ Details Stolen in 2012 Breach
October 6, 2017
Another day, Another data breach disclosure. This time the popular commenting system has fallen victim to a massive security breach. Disqus, the company which provides a web-based comment plugin for websites and blogs, has admitted that it was breached 5 years ago in July 2012 and hackers stole details of more than 17.5 million users. The stolen data ...
- Spy vs spy vs hacker vs… who is THAT? Everyone’s hacking each other
October 5, 2017
VB2017 Intel agencies and top-tier hackers are actively hacking other hackers in order to steal victim data, borrow tools and techniques, and reuse each other’s infrastructure, attendees at Virus Bulletin Con, Madrid, were told yesterday. The increasing amount of spy-vs-spy type activity is making accurate threat intel increasingly difficult for security researchers, according to Kaspersky Lab. Threat intelligence ...
- FormBook—Cheap Password Stealing Malware Used In Targeted Attacks
October 5, 2017
It seems sophisticated hackers have changed the way they conduct targeted cyber operations—instead of investing in zero-days and developing their malware; some hacking groups have now started using ready-made malware just like script kiddies. Possibly, this could be a smart move for state-sponsored hackers to avoid being attributed easily. Security researchers from multiple security firms, including Arbor Networks and FireEye, ...
- Equifax Says 145.5M Affected by Breach, Ex-CEO Testifies
October 3, 2017
Equifax, the credit agency behind this summer’s breach of 143 million Americans, said this week the number of victims implicated in the breach has increased. Paulino do Rego Barros, Jr., the company’s interim CEO, announced Monday that 2.5 million additional Americans were also impacted, bringing the grand total to 145.5 million affected individuals. Equifax initially called its investigation around ...