🎯There's a new type of malware called NGate that hides in a fake version of a payment app called HandyPay. It tricks people into downloading it and then steals their credit card information when they try to use it. It's been targeting people in Brazil since late 2025, using fake lottery websites and other tricks to get users to install it.
How It Works
The NGate malware family has evolved to target Android users by embedding malicious code in a trojanized version of the HandyPay app, which is a legitimate NFC payment processing tool available on Google Play since 2021. This new variant captures payment card information through the device's NFC chip and sends it to attackers, who can then create virtual cards for unauthorized purchases or ATM withdrawals.
Who's Being Targeted
The ongoing campaign, identified by ESET Research, primarily targets Android users in Brazil. The malware has been active since November 2025, leveraging the popularity of NFC transactions to exploit unsuspecting users.
Distribution Methods
The campaign employs two main distribution vectors:
- Fake Lottery Website: Users are drawn to a fraudulent lottery site where they are promised a prize of R$20,000. To claim the prize, users are redirected to WhatsApp, ultimately leading them to download the trojanized HandyPay APK.
- Fake Google Play Page: The malware is also distributed via a counterfeit Google Play page under the name "Proteção Cartão" (Card Protection), enticing users to download the APK after bypassing Android's sideloading warnings.
Signs of Infection
Once installed, the trojanized HandyPay app prompts users to set it as their default NFC payment app. It then requests their payment card PIN and instructs them to tap their card against the device. The malware relays this information to an attacker-controlled email address, enabling unauthorized transactions.
Technical Insights
ESET researchers noted that the malicious code includes emojis in the log strings, suggesting the potential use of generative AI tools in its development. This aligns with a growing trend where cybercriminals leverage AI to produce sophisticated malware without extensive programming knowledge.
How to Protect Yourself
Android users are advised to:
Detection
- 1.Avoid downloading APKs from outside the Google Play Store unless they trust the publisher.
- 2.Disable NFC functionality when not in use.
Removal
Conclusion
The NGate malware campaign highlights the increasing sophistication of cyber threats targeting mobile payment systems. Users must remain vigilant and adopt best practices to safeguard their financial information.
The NGate malware's evolution reflects a shift towards more financially motivated cybercrime, utilizing cost-effective methods to evade detection while targeting vulnerable users in the mobile payment ecosystem.
.webp)
