Increased use of global satellite navigation systems (GNSS), for applications such as autonomous vehicles, intelligent transportation systems and drones, heightens security concerns. Civil GNSS signals are vulnerable to notably spoofing and replay attacks. To counter such attacks, cryptographic methods are developed: Navigation Message Authentication (NMA) is one such scheme, about to be deployed for Galileo E1 Open Service (OS); it allows receivers to verify the signal origin and protects navigation message integrity. However, NMA signals cannot fully thwart replay attacks, which do not require forging navigation messages. Classic replay attacks, e.g, meaconing, retransmit previously recorded signals without any modification, thus highly limiting the capacity of the adversary. Distance-decreasing (DD) attacks are a strong type of replay attack, allowing fine-grained individual pseudorange manipulation in real time. Moreover, DD attacks counterbalance processing and transmission delays induced by adversary, by virtue of shifting earlier in time the perceived (relayed) signal arrival; thus shortening the pseudorange measurements. In this paper, we first analyze how DD attacks can harm the Galileo E1 OSNMA service assuming the adversary has no prior information on the navigation message. Moreover,we propose a DD attack detection method based on a Goodness of Fit test on the prompt correlator outputs of the victim. The results show that the method can detect the DD attacks even when the receiver has locked to the DD signals.