WindRelay Android Malware Turns Victims’ Phones Into NFC Relays for Payment Fraud
What Happened – A new Android malware family called WindRelay is being used alongside the SpyNote remote‑access trojan to capture live NFC card data from victims’ phones and forward it to fraudsters in real time. The malware essentially turns a compromised device into a relay for contactless‑payment transactions.
Why It Matters for Compliance & Audit Readiness
- The attack exploits weak mobile‑device controls and demonstrates how a lack of strict access policies can lead to unauthorized data exfiltration – a scenario SOC 2 CC6.1 (Logical Access) and CC7.1 (System Operations) are designed to prevent.
- Continuous evidence of device‑management controls (e.g., NFC disabled on non‑payment devices, approved‑app whitelisting) is required to show auditors that the organization mitigates this vector.
- Security Awareness Training that covers malicious‑app distribution and NFC‑related threats helps satisfy SOC 2 CC1.1 (Control Environment) by proving that personnel are educated on emerging mobile risks.
Who Is Affected – Financial services, retail merchants, and any organization that processes contactless payments on mobile devices; also end‑users of Android smartphones.
Recommended Actions
- Map the incident to SOC 2 controls CC6.1 and CC7.1; collect evidence of mobile‑device policy enforcement (MDM logs, NFC‑disable configurations).
- Enforce strict app vetting and whitelist only approved Android applications on devices used for payments.
- Deploy Security Awareness Training focused on malicious‑app risks and NFC fraud scenarios.
- Implement real‑time monitoring for anomalous NFC traffic and RAT activity on endpoints.
Source: The Hacker News
Technical Notes – WindRelay is a purpose‑built NFC relay that works with SpyNote RAT to stream card data. The malware captures NFC payloads, encrypts them, and sends them over C2 channels. No specific CVE is cited; the threat relies on Android’s NFC stack and user‑installed malicious apps. Source: Group‑IB analysis