New NGate Malware Developed Using AI Hides in NFC Payment Apps

A trojanized HandyPay Android NFC relay app is being distributed outside Google Play and contains a new NGate variant that silently captures NFC payment card data and user PINs, exfiltrating them to an attacker-controlled C2 to enable contactless payments and ATM cash-outs; distribution channels include a fake Brazilian lottery site and impersonated Play Store pages, the campaign targets users in Brazil and shows signs of AI-assisted code generation.