Android malware combo takes out loans and relays victims' credit cards

Attackers combined SpyNote RAT and WindRelay malware to execute a sophisticated two-stage attack: social engineering tricks victims into sideloading SpyNote, which grants remote access, while WindRelay silently relays NFC payment card data in real time during a fake payment interaction. This attack is particularly dangerous because it bypasses traditional card-not-present fraud controls by using the victim's physical device as a live relay, making fraudulent transactions appear legitimate. The root failure lies in victims' inability to recognize social engineering tactics and the permissive nature of Android sideloading. This matters because financial losses can be immediate and difficult to reverse, and victims may not realize they've been compromised until significant damage is done.