AI-Powered NGate Malware Evades Detection Inside NFC Payment Apps

ESET Research identified a trojanized variant of HandyPay that contains NGate malware which intercepts NFC payloads and captures card data and PINs, relaying them to attacker-controlled devices for contactless fraud and ATM cash‑outs; distribution uses sideloaded APKs via a fake lottery site and spoofed Play-like pages targeting users in Brazil, with multiple IOCs and evidence of active exfiltration to a C2 server.