Malware

SpyMax

SpyMax is a popular Android surveillance tool. Its predecessor, SpyNote, was one of the most widely used spyware frameworks.

Indicators of Compromise 6

Filename SpyNote.apk Filename WindRelay.apk IP 91[.]108[.]20[.]15 IP 91[.]108[.]20[.]16 IP 91[.]108[.]20[.]17 IP 91[.]108[.]20[.]18

MITRE ATT&CK TTPs 8

T1056
Input Capture
Collection
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1095
Non-Application Layer Protocol
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1132.001
Standard Encoding
Command And Control
 T1219
Remote Access Software
Command And Control
 T1482
Domain Trust Discovery
Discovery

Source Articles

Android malware combo takes out loans and relays victims' credit cards
A new Android malware campaign combines WindRelay, an NFC relay tool, with the SpyNote remote administration trojan to enable real-time financial fraud. Attackers socially engineer victims by impersonating bank employees, tricking them into sideloading a malicious APK that grants Accessibility Services, enabling remote device control. The attackers then install WindRelay to capture NFC payment card data and PINs during live phone calls, allowing them to conduct fraudulent transactions or take out loans in the victim's name. The attack chain was executed entirely over a 13-minute call, highlighting a shift toward real-time, voice-mediated social engineering without requiring persistent malware access.
bleeping-computer ·5h ago