{"id":52137,"date":"2026-09-29T15:10:37","date_gmt":"2026-09-29T15:10:37","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=52137"},"modified":"2026-09-29T15:10:37","modified_gmt":"2026-09-29T15:10:37","slug":"new-android-malware-lets-scammers-drain-bank-accounts-and-atms-without-stealing-your-bank-card","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=52137","title":{"rendered":"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card"},"content":{"rendered":"

\"\"<\/p>\n

Scammers are draining bank accounts and pulling cash from ATMs without needing the victim\u2019s debit card in hand.<\/p>\n

Experts at the cybersecurity firm Group-IB say<\/a> they have uncovered a previously unseen Android malware family they are calling WindRelay, built to capture live near-field communication (NFC) payment data and forward it in real time to attackers.<\/p>\n

On a call that lasts about 13 minutes, someone posing as a bank worker talks the victim into installing an app. That app lets the scammer take over the phone and quietly add WindRelay.<\/p>\n

Once both tools are on the device, scammers open the victim\u2019s real banking app, arrange loans and tell the target to tap their payment card against the phone and enter the PIN.<\/p>\n

WindRelay turns the phone into a fake contactless reader. The live tap, including the one-time code from the card, is streamed to a device the criminals hold against an ATM or store terminal. The tap then goes through as if the real card were there.<\/p>\n

Says Group-IB,<\/p>\n

\u201cIn one 13-minute phone call, the victim installed a RAT onto their own device \u2014 everything after that was performed by the fraudster. By the end of the call, the fraudster had taken out a loan in the victim\u2019s name through remote access to the victim\u2019s mobile app, and was streaming their card data to a fake merchant terminal.\u201d<\/em><\/p>\n

Researchers tied 23 WindRelay samples uploaded to VirusTotal between November of 2025 and July of 2026 to campaigns aimed at bank customers in Czechia, Slovakia and Slovenia. They linked the samples to four command-and-control servers.<\/p>\n

Follow us on X<\/a>, Facebook<\/a> and Telegram<\/a><\/span><\/em>
\n
\nDon’t Miss a Beat \u2013 Subscribe<\/a> to get email alerts delivered directly to your inbox <\/span><\/em>
\n<\/p>\n

\n
<\/div>\n

&nbsp<\/p>\n

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.<\/h6>\n<\/div>\n

Generated Image: Midjourney<\/em><\/p>\n

The post New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card<\/a> appeared first on The Daily Hodl<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Scammers are draining bank accounts and pulling cash from ATMs without needing the victim\u2019s debit card in hand. Experts at the cybersecurity firm Group-IB say they have uncovered a previously unseen Android malware family they are calling WindRelay, built to capture live near-field communication (NFC) payment data and forward it in real time to attackers. […]<\/p>\n","protected":false},"author":1,"featured_media":52138,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"class_list":["post-52137","post","type-post","status-publish","format-standard","has-post-thumbnail"],"yoast_head":"\nNew Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=52137\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"Scammers are draining bank accounts and pulling cash from ATMs without needing the victim\u2019s debit card in hand. Experts at the cybersecurity firm Group-IB say they have uncovered a previously unseen Android malware family they are calling WindRelay, built to capture live near-field communication (NFC) payment data and forward it in real time to attackers. […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=52137\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-29T15:10:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dailyhodl.com\/wp-content\/uploads\/2026\/09\/ghost-tapping-credit_pink.jpg?resize=1024,600\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card\",\"datePublished\":\"2026-09-29T15:10:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137\"},\"wordCount\":409,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/ghost-tapping-credit_pink-0j8tr2.jpg\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137\",\"name\":\"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/ghost-tapping-credit_pink-0j8tr2.jpg\",\"datePublished\":\"2026-09-29T15:10:37+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=52137\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/ghost-tapping-credit_pink-0j8tr2.jpg\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/ghost-tapping-credit_pink-0j8tr2.jpg\",\"width\":1024,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=52137#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=52137","og_locale":"en_US","og_type":"article","og_title":"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card - Cryptomag","og_description":"Scammers are draining bank accounts and pulling cash from ATMs without needing the victim\u2019s debit card in hand. Experts at the cybersecurity firm Group-IB say they have uncovered a previously unseen Android malware family they are calling WindRelay, built to capture live near-field communication (NFC) payment data and forward it in real time to attackers. […]","og_url":"https:\/\/cryptomag.finance\/?p=52137","og_site_name":"Cryptomag","article_published_time":"2026-09-29T15:10:37+00:00","og_image":[{"url":"https:\/\/dailyhodl.com\/wp-content\/uploads\/2026\/09\/ghost-tapping-credit_pink.jpg?resize=1024,600","type":"","width":"","height":""}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=52137#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=52137"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card","datePublished":"2026-09-29T15:10:37+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=52137"},"wordCount":409,"image":{"@id":"https:\/\/cryptomag.finance\/?p=52137#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/ghost-tapping-credit_pink-0j8tr2.jpg","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=52137","url":"https:\/\/cryptomag.finance\/?p=52137","name":"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=52137#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=52137#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/ghost-tapping-credit_pink-0j8tr2.jpg","datePublished":"2026-09-29T15:10:37+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=52137#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=52137"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=52137#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/ghost-tapping-credit_pink-0j8tr2.jpg","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/ghost-tapping-credit_pink-0j8tr2.jpg","width":1024,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=52137#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"New Android Malware Lets Scammers Drain Bank Accounts and ATMs \u2013 Without Stealing Your Bank Card"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/52137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=52137"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/52137\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/52138"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=52137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=52137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=52137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}