NGate: NFC Relay Malware Enabling ATM Withdrawals Without Physical Cards

CERT Polska uncovered NGate, a sophisticated Android malware campaign targeting Polish bank customers that abuses Android Host Card Emulation (HCE) and HostApduService to capture NFC payment exchanges and PINs via phishing-distributed fake banking apps; attackers relay the captured data to attacker-controlled devices at ATMs to perform unauthorized cash withdrawals, and vendors report on-device detection for known variants.