Researchers described a real scam where criminals called victims pretending to be bank support and convinced them to install a “legitimate” Android app. The app was actually SpyNote malware, giving the attacker remote control of the phone, after which a second tool (WindRelay) was used to relay live NFC (tap-to-pay) transactions and steal money within minutes.
This attack, documented by Group-IB, began with a phone call. The caller impersonated bank support staff and convinced the victim that an account issue needed to be resolved by installing an app. That app was a customized version of the SpyNote Android remote access trojan, personalized with the victim's own name to appear credible. Because it was sideloaded from outside Google Play, the victim also had to be talked into granting the Android Accessibility Service permission, which gave the attacker the ability to view and control the device's screen remotely.
Once the attacker had remote control, they deployed a second tool, WindRelay, to relay live NFC (tap-to-pay) transactions. According to Group-IB, the entire sequence, from the initial support call to a completed live NFC fraud transaction, took about 13 minutes. Attackers reportedly also took out a loan in the victim's name as part of the broader fraud.
The scheme worked because it layered several trust-building steps on top of each other:
Key red flags identified in this attack pattern include:
Awareness efforts should reinforce a few concrete habits. Treat unsolicited bank support calls with suspicion, and instead hang up and call back using the number on the back of your card or the bank's official website. Only install apps from official stores such as Google Play, never based on instructions from a phone call. Be cautious about granting Accessibility permissions, since this level of access can enable full remote control of a device. Finally, remember that a legitimate bank representative should never need you to sideload an app, grant special device permissions, or use your payment card to resolve a support issue. These habits directly counter each step used in this real-world attack chain.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers called victims pretending to be bank support and convinced them to sideload a customized Android app that was actually the SpyNote remote access trojan.
The SpyNote app was personalized with the victim's own name, which made it appear legitimate during the phone call.
Group-IB reported that the end-to-end process from the initial support call to live NFC fraud took about 13 minutes.
They persuaded victims to grant the Android Accessibility Service permission, which let the attacker view and control screen content remotely.
Imagine this: a “bank support” call, and 13 minutes later, your Android is running live tap-to-pay fraud. Researchers saw this: caller pretends to fix an issue, walks the victim through installing a “support” app that’s actually SpyNote, sideloaded outside Google Play, then tricks them into granting Android Accessibility so they can drive the phone remotely. Once SpyNote is in, they push WindRelay, tell the victim to 'make a test payment,' and relay live NFC transactions in the background, plus classic fraud like taking out a loan in the victim’s name. Here’s your move: if “bank support” ever asks you to install an app or use your card on that call, hang up and call the number on the back of your card instead.
Researchers say criminals are using a two-part Android malware setup (SpyNote + WindRelay) to trick victims into turning their own phones into NFC “relays” for contactless payment fraud. Victims are lured via phishing/smishing/vishing to install a malicious app, then persuaded on a live call to tap…
Researchers described a real scam where criminals impersonated a bank on a phone call to trick a victim into installing a malicious Android app. The attackers then remotely controlled the phone and guided the victim to tap their payment card and enter their PIN, allowing real-time contactless fraud…
Researchers reported a real-world phone scam where criminals impersonated a victim’s bank and coached the victim into installing an Android app. The installed remote-access malware let the fraudster silently add a second NFC relay app that streamed the victim’s payment card data to a fake terminal,…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers say the BlackFile extortion group is actively targeting large financial and other organizations using voice-phishing calls where attackers impersonate IT support to get initial access. Victims are then pressured with multimillion-dollar extortion demands and, in some cases, escalations…
