New Android NFC Relay Malware “WindRelay” Enables Real‑Time Card Theft via Compromised Phones
What Happened — Researchers at Group‑IB identified a novel Android malware family, WindRelay, that captures live NFC payment‑card data on an infected phone and relays it instantly to a criminal‑controlled device, allowing purchases or cash withdrawals in real time. The infection chain begins with a social‑engineering phone call that convinces victims to install a banking‑branded RAT (SpyNote), which then drops WindRelay.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how a lack of robust security awareness training can lead to credential compromise and downstream data exfiltration, a scenario SOC 2 CC6.1 (Logical Access) and CC7.1 (Security Awareness) are designed to prevent and document.
- Real‑time NFC relay creates a data‑exfiltration event that must be captured as audit evidence for the SOC 2 Security principle (CC3.1) and for incident‑response readiness.
- Continuous monitoring of mobile‑device controls and third‑party app vetting provides defensible proof that access controls are enforced, aligning with Verisq’s Security Awareness capability.
Who Is Affected — Financial services (banks, payment processors), mobile‑payment app providers, and any organization that issues contactless cards to customers.
Recommended Actions
- Map the incident to SOC 2 CC6.1 (Logical Access) and CC7.1 (Security Awareness) controls; verify that training records, phishing‑test results, and policy acknowledgments are up‑to‑date and auditable.
- Deploy mobile‑device management (MDM) policies that restrict installation of unknown apps and enforce app‑signing verification.
- Conduct a tabletop exercise simulating an NFC‑relay attack to test incident‑response playbooks and evidence‑collection procedures.
Source: Malwarebytes Labs
Technical Notes — The attack chain uses a social‑engineering phone call → malicious Android app (SpyNote RAT) → secondary payload (WindRelay) that hooks the Android NFC stack, captures dynamic cryptograms, and forwards them over an encrypted channel to a remote device. No CVE is involved; the threat leverages legitimate NFC protocols and dynamic token generation. Source: Group‑IB research summary linked above