New NGate Malware Developed Using AI Hides in NFC Payment Apps

Cybersecuritynews •Tushar Subhra Dutta • April 21, 2026

A new and more dangerous version of the NGate malware has been found hiding inside a trojanized NFC payment application. This time, threat actors appear to have used artificial intelligence to help write the malicious code, which marks a significant shift in how cybercriminals are building attack tools today. The malware targets Android users by […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New NGate Malware Variant Exploits HandyPay App to Steal NFC Payment Data ESET Research has identified a new variant of the NGate malware family that targets Android users in Brazil by embedding malicious code in a trojanized version of the HandyPay app. This malware allows attackers to capture NFC payment card data and PINs for unauthorized transactions and ATM withdrawals. The campaign, which began in November 2025, utilizes social engineering tactics to distribute the malicious app through fake lottery websites and a fraudulent Google Play page. The trojanized HandyPay app has never been available on the official Google Play store, and its malicious functionality is designed to evade detection by requiring minimal permissions. Researchers noted that the malware code shows signs of being generated with AI tools, indicating a shift in how cybercriminals develop malware. ESET has shared its findings with Google and the HandyPay developers, who are investigating the misuse of their application. Android users are advised to be cautious about downloading apps from unofficial sources and to utilize Google Play Protect. 9 sources 70

Extracted Entities

New NGate Malware Developed Using AI Hides in NFC Payment Apps

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (1)