ESET Uncovers NGate Malware in Brazilian Payment App

Cybersecurity researchers at ESET have uncovered a new variant of the Android malware known as NGate, which targets users in Brazil by embedding malicious code into a legitimate payment application called HandyPay to steal sensitive NFC payment data.

The campaign, active since November 2025, focuses on Android devices and exploits the app's NFC relay functionality to capture card details and PINs during contactless transactions. Once installed, the trojanized HandyPay prompts users to set it as the default payment app, enter their card PIN, and tap the card against the phone. At that point, the malware relays the NFC data to an attacker-controlled device, enabling fraudulent activities such as unauthorized ATM withdrawals and purchases. The stolen PINs are separately sent to a command-and-control server, where logs from at least four compromised devices in Brazil have been identified, including IP addresses and timestamps.

ESET researcher Lukáš Štefanko explained that the attackers modified HandyPay by injecting harmful code, likely to capitalize on its low cost and minimal permissions compared to pricier alternatives like NFU Pay or TXNFC, which charge around $400 to $500 per...