WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud

A previously unseen Android near field communication (NFC) relay malware family dubbed WindRelay is being deployed in conjunction with a known remote access trojan (RAT) called SpyNote as part of a contactless payment fraud scheme. The purpose-built malware, according to Group-IB, is designed to capture live card data via NFC and transmit it to fraudsters in real time. It was first detected in

Report facts: The article describes WindRelay, a new Android malware that abuses NFC capabilities in combination with the SpyNote remote access trojan to relay live card data from victim devices to fraudsters for contactless payment fraud. The campaign weaponizes mobile device features and remote control tooling to execute real-time payment abuse, but does not explicitly involve AI models or AI-driven decision-making. RealGround analysis: While this is primarily a mobile banking and payment security incident rather than an AI-specific attack, it is relevant as an example of how advanced fraud tooling and remote compromise techniques could be integrated into future AI-driven payment or risk engines. Organizations deploying AI in fintech or mobile ecosystems should ensure their AI security programs and red-teaming exercises consider upstream device compromise and malicious automation as part of end-to-end fraud and abuse scenarios.