NGate Android malware uses HandyPay NFC app to steal card data

ESET researchers report a new NGate Android variant that steals NFC payment card data by using a trojanized HandyPay app; attackers distribute fake APKs and social-engineered pages to get victims to set the app as the default NFC payment handler, collect card PINs and NFC reads, and exfiltrate data to a hardcoded email—campaign active since November 2025 and primarily targeting Android users in Brazil.