Loading story…
ESET researchers reported an NGate malware campaign targeting Android users in Brazil through a trojanized version of the legitimate HandyPay NFC relay app. Active since November 2025, the operation distributes malicious APKs via a fake Rio de Prêmios lottery site that redirects victims through WhatsApp and through counterfeit Google Play pages promoting an app called Proteção Cartão. After installation, the app prompts victims to set it as the default NFC payment app, captures card PINs, and harvests payment card data for relay to attacker-controlled infrastructure.
The stolen NFC data can be used to provision virtual cards for fraudulent contactless purchases and NFC-enabled ATM withdrawals. ESET said this variant differs from earlier NGate activity by abusing HandyPay’s built-in NFC transfer features instead of the open-source NFCGate tool, a change researchers believe improves stealth and lowers operational cost. The two observed samples were linked to the same threat actor through shared infrastructure and the same modified HandyPay build, while unusual emoji-filled code suggested possible GenAI-assisted development, though ESET said that remains unconfirmed. Google was notified through the App Defense Alliance, HandyPay’s developer opened an internal investigation, and Google Play Protect is reported to detect and block the latest variant.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
ESET reported the campaign to Google through the App Defense Alliance and notified the HandyPay developer. The developer said an internal investigation was underway, and Google Play Protect was reported to detect and block the latest NGate variant.
Researchers connected two NGate samples to the same actor based on shared infrastructure and use of the same modified HandyPay application. ESET also noted code characteristics that may indicate generative AI assistance, though it said this was not proven.
Once installed, the trojanized app prompted victims to set it as the default NFC payment app, then captured payment card data and card PINs. The stolen NFC data was relayed to attacker-controlled infrastructure for fraudulent contactless purchases and ATM withdrawals.
The threat actor used a fake Rio de Prêmios lottery website that redirected victims through WhatsApp, as well as a fake Google Play-style page offering the malware as Proteção Cartão. These lures delivered malicious APKs to victims' Android devices.
ESET said the NFC-based payment fraud campaign using a new NGate malware variant has been active since November 2025. The operation targeted Android users in Brazil with malware embedded in a trojanized version of the legitimate HandyPay app.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new Android malware known as **NGate** has been identified targeting mobile devices to steal cash from ATMs by relaying EMV card data and PINs from victims' phones. The malware leverages NFC capabilities to intercept sensitive payment information, which is then used to facilitate unauthorized ATM withdrawals. Security researchers have highlighted the technical sophistication of NGate, which can bypass traditional security controls by exploiting the contactless payment features on compromised devices. Reports indicate that NGate is distributed through malicious APKs and is part of a broader trend of mobile malware targeting financial transactions. The malware's ability to relay EMV data and PINs poses a significant threat to both individual users and financial institutions, as it enables attackers to perform real-time fraudulent cash withdrawals. Security experts recommend heightened vigilance for suspicious mobile applications and urge users to monitor their devices for signs of compromise.
Jun 29, 2026
Researchers have identified a surge in Android malware abusing Near-Field Communication (NFC) and Host Card Emulation (HCE) to steal payment data and facilitate unauthorized transactions. Over 760 malicious apps have been discovered targeting banks, payment services, and government portals worldwide, including institutions in Russia, Europe, and Brazil. These apps often impersonate trusted organizations, urging users to set them as default NFC payment handlers, and exfiltrate sensitive EMV card data—such as device IDs, card numbers, and expiry dates—via Telegram channels. Attackers remotely control the apps through command-and-control servers, enabling them to relay card terminal requests, provide PINs, and execute fraudulent transactions with minimal user interaction. The rapid adoption of "Tap-to-Pay" has made NFC a lucrative target, with over 70 C2 servers and dozens of Telegram bots coordinating attacks against more than 20 global institutions since April 2024. CERT Polska has specifically analyzed the NGate malware campaign, which employs NFC relay attacks to enable unauthorized ATM withdrawals using victims’ own payment cards. Victims are lured through phishing messages and social engineering phone calls, convincing them to install a malicious Android app and verify their payment card by tapping it against their phone and entering their PIN. The app captures the NFC exchanges and PIN, relaying this data to an attacker-controlled device at an ATM, allowing criminals to withdraw cash without physical access to the card. The malware registers itself as an HCE payment service and conceals its C2 infrastructure within encrypted assets, complicating detection and response efforts.
Jul 12, 2026
Security researchers have identified a surge in Android malware that abuses Near Field Communication (NFC) and Host Card Emulation (HCE) features to steal payment data and conduct fraudulent transactions. Since April 2024, over 760 malicious apps have been detected, with campaigns expanding from isolated incidents to a global threat affecting users in Russia, Poland, the Czech Republic, Slovakia, Brazil, and other countries. These apps impersonate trusted financial institutions and government services, including the Central Bank of Russia, Gosuslugi, Santander, and VTB Bank, to deceive users into installing them and setting them as the default payment method. Once installed, the malware activates NFC relay functionality, capturing card data in real time and forwarding it to attacker-controlled servers. The operation is coordinated through more than 70 command-and-control servers and numerous Telegram bots, enabling attackers to use one infected device to collect payment data and another to complete fraudulent transactions at physical terminals. The rapid proliferation and sophistication of these attacks highlight the growing risk to mobile payment systems and the need for increased vigilance among Android users and financial institutions.
Jul 12, 2026