NGate NFC malware targets Android users through trojanized payment app

ESET Research identified an active Brazil-focused campaign (since November 2025) that trojanizes the HandyPay NFC payment app with a new NGate malware variant to relay contactless card data and exfiltrate PINs to an attacker C2; distribution uses a rigged lottery website and a fake Google Play page, enabling contactless transactions and ATM withdrawals with stolen credentials.