# New NGate variant hides in a trojanized NFC payment app

Trojanized HandyPay Android app relays victims' NFC card data to attacker devices and exfiltrates card PINs, enabling ATM cash-outs and unauthorized payments in Brazil.

- Payout: Real-world hack
- Severity: high
- Program: HandyPay
- Analysis by: ESET Research
- Disclosed: 2026-04-21
- Write-up quality: 6/10
- Original: https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/
- Library page: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-new-ngate-variant-hides-in-a-trojanized-nfc-payment-app
- Tags: area:web3 domain:mobile domain:web3 impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:high tech:android tech:payment technique:reverse-engineering vuln:info-disclosure

**Target:** Android NFC payment relay app (HandyPay) and its C&C server
**Root cause:** Threat actors patched the legitimate HandyPay NFC relay app with malicious code (likely AI-generated) that hardcodes an attacker email so all relayed NFC card data routes to the operator's device, plus a separate HTTP exfiltration routine for the victim's card PIN.
**Steps:**
1. Distribute trojanized HandyPay APK via fake Rio de Prêmios lottery site or fake Google Play page (Proteção Cartão) on protecaocartao[.]online
2. Victim sideloads APK, enabling 'Allow from this source'
3. App requests to be set as default payment app (legitimate HandyPay behavior)
4. Victim enters payment card PIN into the app and taps card on NFC-enabled phone
5. Malware relays NFC card data via HandyPay service to attacker device linked to hardcoded email
6. PIN is exfiltrated separately over HTTP to C&C server (108.165.230[.]223)
**How found:** ESET analyzed two NGate samples hosted on the same domain sharing the same patched HandyPay base, and inspected the C&C server, finding logs from four compromised Brazilian devices containing captured PINs, IPs and timestamps; emoji in malware logs suggested AI-generated code.
**Exploitation:** Victim is socially engineered into installing the patched APK, sets it as default payment app, enters PIN and taps card; NFC data is relayed to the operator's paired device, which uses it for contactless ATM cash-outs and unauthorized payments, while the PIN is sent to the C&C for separate harvesting.
**Insight:** Legitimate NFC-relay apps that require no permissions and only default-payment-app status are attractive trojanization bases because they avoid permission prompts; check whether relayed data is bound to a hardcoded account/email rather than the user's own pairing, and monitor for PIN capture separate from the relay channel.