Researchers say criminals are using a two-part Android malware setup (SpyNote + WindRelay) to trick victims into turning their own phones into NFC “relays” for contactless payment fraud. Victims are lured via phishing/smishing/vishing to install a malicious app, then persuaded on a live call to tap their payment card to the infected phone under a fake “verification/PIN change” pretext, enabling real-time fraudulent transactions.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you tap your card on your own phone, and someone else goes shopping with it in real time. Scammers use WindRelay and SpyNote on Android to do exactly that. They call as “bank security,” send you a personalized APK with your name, and walk you through installing a fake verification app. On the live call they say, “Tap your card to your phone so we can verify your identity or change your PIN.” The instant you tap, your phone becomes an NFC relay, and they can run real contactless payments somewhere else. If anyone claiming to be your bank ever asks you to install an app or tap your card to your phone, hang up and call the bank back using the number on your card.
Researchers described a real scam where criminals called victims pretending to be bank support and convinced them to install a “legitimate” Android app. The app was actually SpyNote malware, giving the attacker remote control of the phone, after which a second tool (WindRelay) was used to relay…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
A real campaign is targeting logistics firms with fake Google Play pages impersonating well-known logistics brands to trick employees into installing an Android spyware app. Once installed, the spyware can steal newly received SMS messages (including one-time passcodes) and enable call forwarding,…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
Researchers describe BraZetsu, a Windows malware framework used by an initial-access broker to turn infected PCs into "access for sale" on a criminal marketplace. While the malware itself is technical, the article includes real-world delivery details pointing to phishing: victims are tricked into…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
