Researchers described a real scam where criminals impersonated a bank on a phone call to trick a victim into installing a malicious Android app. The attackers then remotely controlled the phone and guided the victim to tap their payment card and enter their PIN, allowing real-time contactless fraud (“ghost tapping”) at payment terminals or contactless ATMs.
A victim received a phone call from someone claiming to be their bank. Over a 13 minute conversation, the caller convinced the victim to install an Android app labeled with the bank's name. That app was actually SpyNote, a remote access Trojan that gave the attackers control-style access to the phone. Using that access, the attackers quietly installed a second app, WindRelay, built to relay NFC payment data in real time.
With both apps in place, the attackers remotely opened the victim's legitimate banking app and arranged a loan in the victim's name. At the same time, they instructed the victim to tap their physical payment card against the phone and enter its PIN. That tap allowed the second app to forward the card's contactless data to the criminals at the exact moment of the tap, enabling purchases or ATM withdrawals.
The phone call was not just a lure to get malware installed, it also served as the attackers' control channel throughout the fraud. Staying on the line let them respond to the victim's confusion instantly and coordinate the precise timing needed for installation, the card tap, and PIN entry. Because modern contactless payments rely on dynamic, one-time transaction codes, this real-time coordination was essential for the fraud to work at all.
Organizations and individuals can reduce exposure to this kind of attack by reinforcing a few habits. Treat unexpected urgent bank calls as suspicious and slow down before acting on any request. Verify claims by calling the bank back using an official number looked up independently, never one provided during the call. Remember that a bank will not ask someone to install an app from an unofficial source to secure a card. Finally, avoid sideloading apps outside of official app stores, and treat unexpected requests for Accessibility or device-control permissions as a serious warning sign, since that access is what let the attackers operate the phone and time the fraud around the victim's card tap and PIN entry.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Ghost tapping refers to criminals relaying a victim's contactless card data in real time to a payment terminal or ATM, allowing them to make purchases or withdraw cash using data captured at the moment the victim taps their card.
A caller impersonated the victim's bank during a 13 minute phone call and convinced the victim to install an Android app labeled with the bank's name, which was actually the SpyNote remote access Trojan.
Modern contactless payments use dynamic, one-time transaction codes, so the attackers needed the card tap and PIN entry to happen live so a second app could relay that data to them in real time.
Hang up and call the bank back using an official number you look up yourself, and never install an app or enter a PIN based on instructions given during an unsolicited call.
You get a call: “Hello, this is the bank about your card. We need you to install our app now to secure your account.” In a real case, a 13‑minute call like this pushed a victim to install an Android app with the bank’s name that was actually SpyNote, a remote access Trojan. While they stayed on the line, SpyNote quietly installed a second app, WindRelay, to hijack NFC payments. From there, the caller remotely opened the real banking app, took out a loan in the victim’s name, then said, “To verify your card, tap it to your phone and enter your PIN now.” That tap let WindRelay ghost‑tap their card at a real terminal. If any ‘bank’ call tells you to install an app or tap your card to your phone, hang up and call the bank back using the number on your card or their official website.
Researchers described a real scam where criminals called victims pretending to be bank support and convinced them to install a “legitimate” Android app. The app was actually SpyNote malware, giving the attacker remote control of the phone, after which a second tool (WindRelay) was used to relay…
Researchers say criminals are using a two-part Android malware setup (SpyNote + WindRelay) to trick victims into turning their own phones into NFC “relays” for contactless payment fraud. Victims are lured via phishing/smishing/vishing to install a malicious app, then persuaded on a live call to tap…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
Attackers are exploiting GTA 6 hype by creating convincing fake Rockstar-branded “demo” websites that appear in Google search results. The sites use “Play Now”/“Official Download” lures to trick people into downloading a small Windows executable that installs Vidar infostealer and steals saved…
Researchers report Iranian-linked APT groups using legitimate cloud services to hide command-and-control traffic, and separately running spear-phishing campaigns. In the phishing cases, attackers used credible “podcast” or “interview invitation” themes to persuade targets to open a Windows shortcut…
