NGate Campaign Targets Brazil, Trojanizes HandyPay to Steal NFC Data and PINs

Researchers discovered a new Android malware campaign called NGate that trojanizes the HandyPay NFC app to steal payment card data and PINs in Brazil.

• •The malware patches legitimate NFC relay apps to intercept contactless payment data, enabling unauthorized ATM cash-outs and fraudulent transactions
• •Victims are lured via fake lottery websites (Rio de Prêmios) and fake Google Play Store listings to install the poisoned HandyPay app
• •The malware captures payment card PINs and exfiltrates data to attacker command-and-control servers for fraudulent use
• •Analysis shows signs of AI-generated code, with LLM-generated emojis in debug messages, indicating criminals using generative AI to produce malware
• •The campaign began around November 2025, targeting Brazilian users specifically, leveraging HandyPay's cheaper subscription rates as a cost-effective alternative