AI

Gbhackers •Mayura Kathir • April 21, 2026

A new NGate malware variant that hides inside a trojanized version of HandyPay, a legitimate NFC payment relay app for Android, to steal card data and PINs for ATM cash-outs and fraudulent payments. The injected code shows clear signs of being produced with generative AI, highlighting how low‑skill actors can now weaponize NFC payment apps […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New NGate Malware Variant Exploits HandyPay App to Steal NFC Payment Data ESET Research has identified a new variant of the NGate malware family that targets Android users in Brazil by embedding malicious code in a trojanized version of the HandyPay app. This malware allows attackers to capture NFC payment card data and PINs for unauthorized transactions and ATM withdrawals. The campaign, which began in November 2025, utilizes social engineering tactics to distribute the malicious app through fake lottery websites and a fraudulent Google Play page. The trojanized HandyPay app has never been available on the official Google Play store, and its malicious functionality is designed to evade detection by requiring minimal permissions. Researchers noted that the malware code shows signs of being generated with AI tools, indicating a shift in how cybercriminals develop malware. ESET has shared its findings with Google and the HandyPay developers, who are investigating the misuse of their application. Android users are advised to be cautious about downloading apps from unofficial sources and to utilize Google Play Protect. 9 sources 70

Extracted Entities

AI

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (1)