Trojanized Android App Fuels New Wave of NFC Fraud

ESET researchers identified a new NGate campaign that modifies the HandyPay Android NFC app to stealthily capture payment card data and PINs, relaying them to attacker-controlled infrastructure to enable contactless fraud and ATM withdrawals; the trojanized app has been distributed via phishing since November 2025 and primarily targets users in Brazil, uses minimal permissions by leveraging default payment app behavior, and may include code partially generated with generative AI.