Attackers are distributing a new Android malware called “WindRelay” via phone-based social engineering attacks, according to researchers at Group-IB. The attackers call the victims, impersonating bank employees and instruct them to install a malicious app. In one instance observed by Group-IB, the scammers carried out the entire attack in just thirteen minutes.
“In one 13-minute phone call, the victim installed a RAT onto their own device — everything after that was performed by the fraudster,” Group-IB says. “By the end of the call, the fraudster had taken out a loan in the victim’s name through remote access to the victim’s mobile app, and was streaming their card data to a fake merchant terminal. Every transaction was approved using the PIN the victim had entered themselves. The victim stayed on a live call with the fraudster for the entire incident.”
The use of a single phone call allows the attackers to maintain a sense of urgency and complete the scam before the victim has a chance to collect themselves. The attack chain proceeds as follows:
- “The fraudster called the victim posing as a bank employee, claiming a problem with their bank card.
- The victim installed the first app — a RAT, labeled with the victim’s own name — after being guided to do so by the fraudster on the call.
- Using the RAT’s remote access features, the fraudster then installed a second app — the NFC relay malware — without needing any additional input or action from the victim.
- Once remote access was in place, the fraudster also took the opportunity to issue a loan in the victim’s name. Our investigation indicates that this was likely an add-on to maximize the payout, not a separately planned step.
- The victim tapped their card to their phone and entered their PIN, as instructed.”
AI-native security awareness training can give your employees a healthy sense of suspicion so they can recognize social engineering tactics. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce workforce risk.
Group-IB has the story: https://www.group-ib.com/blog/windrelay-nfc-spynote-rat-combo-fraud/
