New Android Malware 'WindRelay' Enables Remote Bank Account and ATM Fraud

Cybersecurity firm Group-IB has identified a new Android malware family called WindRelay that facilitates unauthorized bank account access and ATM withdrawals. Attackers use social engineering to trick victims into installing a remote access tool, which then turns the victim's smartphone into a contactless payment reader. The malware streams live NFC card data to criminals, allowing them to perform transactions or take out loans in the victim's name. Between November 2025 and July 2026, 23 samples were linked to campaigns targeting users in Czechia, Slovakia, and Slovenia.