ESET Finds NGate Variant Trojanizing HandyPay to Steal Payment Card PINs

Summary

ESET researchers describe an NGate campaign active since November 2025 that trojanizes Android HandyPay to relay payment-card NFC data and steal PINs, distributed through fake Brazilian lottery and Google Play pages.

Key points

The NGate variant patches the legitimate Android HandyPay app to relay victims’ NFC card data to an attacker-controlled device.
The malware captures payment card PINs entered in the app and sends them separately to a command-and-control server over HTTP.
ESET says the campaign has targeted Android users in Brazil since around November 2025; C&C logs contained data from four devices geolocated there.
Two samples were distributed through a fake Rio de Prêmios lottery site and a fake Google Play page for Proteção Cartão; both were hosted on the same domain, suggesting one operator.
Victims had to manually download and install the trojanized app, which was never available on the official Google Play store and required no additional permissions.
Emoji in malware logs led ESET to suggest GenAI may have helped generate or modify the code, but the researchers said this was not definitive.
ESET shared its findings with Google and the HandyPay developer; Google Play Protect covers known versions, and the developer is investigating.

Article Details

Attack Vectors: Trojanized HandyPay Android APKs were distributed from protecaocartao[.]online through a fake Rio de Prêmios lottery site and a fake Google Play page.
The fake lottery site used WhatsApp social engineering to direct victims toward the malicious app.
Victims were prompted to manually download and install the app, including allowing installation from the browser as an unknown source.
The trojanized app captured payment-card PINs through a patched text box and relayed NFC card data to an attacker-controlled device.
Defensive Notes: The maliciously patched HandyPay app was not available on the official Google Play store.
Google Play Protect protects Android users against known versions of the malware and is enabled by default on Android devices with Google Play services.
ESET shared its findings with Google and the HandyPay developer; the developer said it was conducting an internal investigation.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`protecaocartao[.]online`	Malicious distribution domain hosting the trojanized apps and fake lottery and Google Play pages.
IPV4	`108[.]165[.]230[.]223`	NGate C&C server used to receive payment-card PINs over HTTP.
SHA1	`48a0de6a43fc6e49318ad6873ea63fe325200dbc`	SHA-1 hash of a trojanized HandyPay APK identified as Android NGate malware.
SHA1	`94af94ca818697e1d99123f69965b11ead9f010c`	SHA-1 hash of a trojanized Rio_de_Prêmios_Pagamento.apk identified as Android NGate malware.
SHA1	`a4f793539480677241ef312150e9c02e324c0aa2`	SHA-1 hash of a trojanized HandyPay APK identified as Android NGate malware.