NGate Android Malware NFC Theft
NGate is back, and this time it has a specific target. The malware — first documented in Europe, where it was used to clone contactless payment cards and drain ATMs — has now been adapted for a Brazilian campaign. The method is familiar but the execution is localized: attackers trojanized HandyPay, a legitimate NFC-based payment application popular in Brazil, and distributed it through channels designed to look credible to ordinary users. Once installed, the malicious version does what NGate has always done — it intercepts NFC data from bank cards when they come near the infected device and captures PINs as users enter them. The stolen data can be relayed in real time to attackers who use it to conduct fraudulent transactions or clone cards entirely. Both reports landed on the same day, suggesting coordinated disclosure or a shared source feeding the story simultaneously.
If confirmed, here is what this means. Brazil is not an incidental target — it has one of the largest contactless payment ecosystems in Latin America, with Pix and NFC-based transactions now woven deeply into daily commerce. Attacking a trusted app like HandyPay is a social engineering decision as much as a technical one; people extend trust to the apps they already use, which lowers the instinctive friction that might otherwise stop an install. The second-order effect is corrosive: every legitimate NFC payment app in the region now inherits a shadow of suspicion it did not earn. For security teams at Brazilian banks and fintechs, this is a forced conversation about how trojanized versions of their partners' apps reach users and what detection looks like after the fact. NGate's geographic expansion also signals that whoever operates it is deliberately stress-testing it across markets — Europe proved the model, Brazil is proving the scale.
Watch for Brazilian banking institutions or payment processors issuing formal advisories, and for any confirmation from Google or device manufacturers about detection rates in Play Protect — that would sharpen the picture considerably.
A new Android NFC relay malware called WindRelay is being used alongside the SpyNote remote administration tool (RAT) to steal live card data and send it to attackers in real
Social engineering, a Remote Access Trojan (RAT), and NFC relay malware walk up to an ATM. It's no joke. Together, they can empty your bank account.
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →