CYBERSECURITYTRACKER
TRACKING7,811 stories in this site build1,697 vulnerability news stories in this site build
Permanent story citation

Android malware combo takes out loans and relays victims' credit cards

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 4343

As cited

Copy frozen at (site build).

threat intel

Android malware combo takes out loans and relays victims' credit cards

A new Android malware called WindRelay exploits NFC communication to intercept credit card data in real time and works in tandem with SpyNote remote administration tool (RAT) to exfiltrate payment information. The malware also facilitates fraudulent loan applications using stolen victim credentials. Attackers relay the captured card data to themselves immediately, enabling rapid monetization of compromised devices.

Why it matters: Android users with NFC-enabled devices face immediate risk of payment card theft and fraud if malware is installed; defenders should monitor for SpyNote infections and unusual loan application activity tied to customer accounts.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

threat intel

Android malware combo takes out loans and relays victims' credit cards

A new Android malware called WindRelay exploits NFC communication to intercept credit card data in real time and works in tandem with SpyNote remote administration tool (RAT) to exfiltrate payment information. The malware also facilitates fraudulent loan applications using stolen victim credentials. Attackers relay the captured card data to themselves immediately, enabling rapid monetization of compromised devices.

Why it matters: Android users with NFC-enabled devices face immediate risk of payment card theft and fraud if malware is installed; defenders should monitor for SpyNote infections and unusual loan application activity tied to customer accounts.

VendorsGoogle
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary