WindRelay is a newly discovered Android malware family that turns victims' phones into NFC relays for contactless payment fraud. It works with a reader component on the victim's device and an emulator on the attacker's device, communicating via WebSocket. It is often deployed alongside SpyNote RAT and has been observed in Czechia, Slovakia, and Slovenia.