Researchers described a real scam where criminals called victims pretending to be bank support and convinced them to install a “legitimate” Android app. The app was actually SpyNote malware, giving the attacker remote control of the phone, after which a second tool (WindRelay) was used to relay live NFC (tap-to-pay) transactions and steal money within minutes.
This attack, documented by Group-IB, began with a phone call. The caller impersonated bank support staff and convinced the victim that an account issue needed to be resolved by installing an app. That app was a customized version of the SpyNote Android remote access trojan, personalized with the victim's own name to appear credible. Because it was sideloaded from outside Google Play, the victim also had to be talked into granting the Android Accessibility Service permission, which gave the attacker the ability to view and control the device's screen remotely.
Once the attacker had remote control, they deployed a second tool, WindRelay, to relay live NFC (tap-to-pay) transactions. According to Group-IB, the entire sequence, from the initial support call to a completed live NFC fraud transaction, took about 13 minutes. Attackers reportedly also took out a loan in the victim's name as part of the broader fraud.
The scheme worked because it layered several trust-building steps on top of each other:
Key red flags identified in this attack pattern include:
Awareness efforts should reinforce a few concrete habits. Treat unsolicited bank support calls with suspicion, and instead hang up and call back using the number on the back of your card or the bank's official website. Only install apps from official stores such as Google Play, never based on instructions from a phone call. Be cautious about granting Accessibility permissions, since this level of access can enable full remote control of a device. Finally, remember that a legitimate bank representative should never need you to sideload an app, grant special device permissions, or use your payment card to resolve a support issue. These habits directly counter each step used in this real-world attack chain.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers called victims pretending to be bank support and convinced them to sideload a customized Android app that was actually the SpyNote remote access trojan.
The SpyNote app was personalized with the victim's own name, which made it appear legitimate during the phone call.
Group-IB reported that the end-to-end process from the initial support call to live NFC fraud took about 13 minutes.
They persuaded victims to grant the Android Accessibility Service permission, which let the attacker view and control screen content remotely.
Imagine this: a “bank support” call, and 13 minutes later, your Android is running live tap-to-pay fraud. Researchers saw this: caller pretends to fix an issue, walks the victim through installing a “support” app that’s actually SpyNote, sideloaded outside Google Play, then tricks them into granting Android Accessibility so they can drive the phone remotely. Once SpyNote is in, they push WindRelay, tell the victim to 'make a test payment,' and relay live NFC transactions in the background, plus classic fraud like taking out a loan in the victim’s name. Here’s your move: if “bank support” ever asks you to install an app or use your card on that call, hang up and call the number on the back of your card instead.
Researchers described a real scam where criminals impersonated a bank on a phone call to trick a victim into installing a malicious Android app. The attackers then remotely controlled the phone and guided the victim to tap their payment card and enter their PIN, allowing real-time contactless fraud…
Researchers reported a real-world phone scam where criminals impersonated a victim’s bank and coached the victim into installing an Android app. The installed remote-access malware let the fraudster silently add a second NFC relay app that streamed the victim’s payment card data to a fake terminal,…
Researchers say a threat group tracked as UNC6671 is calling employees and posing as IT help desk staff to steal login credentials and multi-factor authentication (MFA) tokens. After gaining access, the attackers reportedly exfiltrate large amounts of corporate data and then issue extortion…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
Proofpoint observed real phishing campaigns using government-themed lures to trick people into downloading ZIP files that install malware. The campaigns used a “crypter” service called Cruciferra to help common remote-access and data-stealing malware evade detection. Financial services, healthcare,…
