NGate Android Malware Targets Brazil, Abuses HandyPay App

A new iteration of the NGate Android malware family is actively targeting users in Brazil, according to The Hacker News. This campaign marks a shift in tactics, with threat actors now abusing the legitimate HandyPay application instead of the previously observed NFCGate.

ESET security researcher Lukáš Štefanko notes that attackers have patched the HandyPay app – designed to relay NFC data – with malicious, seemingly AI-generated code. This trojanized application is then used to steal NFC data and PINs, directly compromising mobile payment security for affected users.

This move from a known malicious app to a legitimate, trusted one is a classic evasion technique. It leverages user trust and bypasses basic app store scrutiny, making detection harder for the average user. Defenders need to recognize this pattern.