Researchers say criminals are using a two-part Android malware setup (SpyNote + WindRelay) to trick victims into turning their own phones into NFC “relays” for contactless payment fraud. Victims are lured via phishing/smishing/vishing to install a malicious app, then persuaded on a live call to tap their payment card to the infected phone under a fake “verification/PIN change” pretext, enabling real-time fraudulent transactions.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you tap your card on your own phone, and someone else goes shopping with it in real time. Scammers use WindRelay and SpyNote on Android to do exactly that. They call as “bank security,” send you a personalized APK with your name, and walk you through installing a fake verification app. On the live call they say, “Tap your card to your phone so we can verify your identity or change your PIN.” The instant you tap, your phone becomes an NFC relay, and they can run real contactless payments somewhere else. If anyone claiming to be your bank ever asks you to install an app or tap your card to your phone, hang up and call the bank back using the number on your card.
Researchers described a real scam where criminals called victims pretending to be bank support and convinced them to install a “legitimate” Android app. The app was actually SpyNote malware, giving the attacker remote control of the phone, after which a second tool (WindRelay) was used to relay…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
Researchers reported a real-world phone scam where criminals impersonated a victim’s bank and coached the victim into installing an Android app. The installed remote-access malware let the fraudster silently add a second NFC relay app that streamed the victim’s payment card data to a fake terminal,…
A financially motivated group called Breeze Comet targeted Brazilian financial and retail organizations by impersonating IT support and convincing staff to install remote-access tools. After gaining access, the attackers moved into internal payment systems (like Pix/STR/Boleto) and executed…
Mandiant and Google report that the financially motivated group BREEZE COMET compromised Brazilian organizations to enable fraudulent bank transfers. The actor used human manipulation (including fake IT support calls) and believable “tax/receipt” downloads hosted on trusted-looking government…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
