Android Malware Turns Phones Into Fraudulent Payment Terminals

A sophisticated Android malware campaign is turning victims' smartphones into fraudulent payment terminals, allowing attackers to steal contactless card data in real time while simultaneously taking out loans in the victims' names. The scheme, uncovered by cybersecurity researchers at GroupIB, involves a combination of social engineering and two distinct malicious applications working in tandem.

The attack begins with a phone call from a fraudster impersonating a bank employee, who claims there is a problem with the victim's payment card. Guided by the caller, the victim is instructed to install an app through their device's package installer. This first app is a variant of the SpyNote remote access trojan, which is personalized with the victim's own name to build trust and lower suspicion. Once installed, the victim grants it Accessibility Service permissions, giving the attacker full remote control of the device.

With remote access secured, the attacker then installs a second, previously unseen malware called WindRelay without any further action from the victim. WindRelay is designed to exploit the phone's Near Field Communication (NFC) capabilities. The victim is instructed...