# New NGate variant hides in a trojanized NFC payment app

DevFeed: [New NGate variant hides in a trojanized NFC payment app](<https://devfeed.tech/articles/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app-8377.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/>)

Author: Lukas Stefanko

Published: 2026-04-21T08:55:00Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Android](<https://devfeed.tech/topics/android.md>), [ESET research](<https://devfeed.tech/topics/eset-research.md>), [genai](<https://devfeed.tech/topics/genai.md>), [Social engineering](<https://devfeed.tech/topics/social-engineering.md>), [App](<https://devfeed.tech/topics/app.md>), [servers](<https://devfeed.tech/topics/servers.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [brazil](<https://devfeed.tech/tags/brazil.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [genai](<https://devfeed.tech/tags/genai.md>), [malware](<https://devfeed.tech/tags/malware.md>), [payment](<https://devfeed.tech/tags/payment.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [threat-report](<https://devfeed.tech/tags/threat-report.md>)

## AI overview

ESET Research reports a new NGate malware variant hidden in a trojanized Android NFC payment app called HandyPay. The malware relays payment-card NFC data, steals card PINs, and exfiltrates them to an operator-controlled server. The active campaign, targeting users in Brazil since around November 2025, distributes the app through fake lottery and Google Play websites; the code may have been assisted by GenAI.

## Source excerpt

ESET researchers discover another iteration of NGate malware, this time possibly developed with the assistance of AI