NGate Android Malware — HandyPay-Trojanized NFC Relay Variant Targets Brazilian Cardholders via Fake Rio de Prêmios Lottery and Counterfeit Google Play Lures

Key facts

Detection coverage

As of 2026-04-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0401 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: NGate HandyPay — Default NFC Payment Handler Change on Sideloaded App (Post-Exploitation)

Detects a non-Google-Play-origin Android application being designated (or requesting designation as) the default NFC/HCE payment handler — the social-engineering step the trojanized HandyPay uses to complete the relay setup. Targets MDM/UEM and Android endpoint event streams that report sideload-install provenance and NFC default-payment-handler changes.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1655.001, T1417.002, T1418
• Data sources: mdm, intune, workspace_one, mobileiron, mde_mobile
• Severity: high
• Confidence: high

Splunk SPL

index=mdm sourcetype IN ("intune:android","workspaceone:android","mobileiron:events") earliest=-24h@h
| search (event_name="NfcDefaultPaymentHandlerChanged" OR event_name="DefaultPaymentApplicationChanged" OR setting_name="default_nfc_payment_handler" OR permission="android.permission.NFC_PAYMENT_DEFAULT")
| eval install_source=coalesce(install_source, installer_package_name, source)
| where install_source!="com.android.vending" AND install_source!="com.google.android.packageinstaller"
| stats count values(package_name) as packages values(install_source) as install_sources values(app_name) as app_names min(_time) as first_seen max(_time) as last_seen by device_id user
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%S")
| table user device_id packages app_names install_sources first_seen last_seen count

Microsoft KQL

DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("NfcDefaultPaymentHandlerChanged","DefaultPaymentApplicationChanged","AppInstalled")
| extend Parsed=parse_json(AdditionalFields)
| extend InstallSource=tostring(Parsed.InstallerPackageName), PackageName=tostring(Parsed.PackageName), AppName=tostring(Parsed.AppName)
| where (ActionType == "NfcDefaultPaymentHandlerChanged" and InstallSource !in ("com.android.vending","com.google.android.packageinstaller")) or (ActionType == "AppInstalled" and InstallSource !in ("com.android.vending","com.google.android.packageinstaller") and PackageName has_any ("handypay","protecao","premios"))
| project Timestamp, DeviceName, DeviceId, AccountName, PackageName, AppName, InstallSource, ActionType
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Packages=make_set(PackageName), Sources=make_set(InstallSource) by DeviceId, AccountName

Sigma

title: Sideloaded Android App Becomes Default NFC Payment Handler
id: 7a1e2c80-0401-4002-bbbb-ngatehp2026
status: experimental
description: Detects an Android app whose installer is not Google Play being designated as the default NFC/HCE payment handler — NGate HandyPay social-engineering signature.
references:
    - https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/
    - https://attack.mitre.org/techniques/T1655/001/
author: Threadlinqs Team
date: 2026/04/21
tags:
    - attack.defense_evasion
    - attack.credential_access
    - attack.t1655.001
    - attack.t1417.002
logsource:
    product: mdm
    category: device_event
detection:
    selection_event:
        event_name:
            - 'NfcDefaultPaymentHandlerChanged'
            - 'DefaultPaymentApplicationChanged'
    filter_legit_installer:
        installer_package_name:
            - 'com.android.vending'
            - 'com.google.android.packageinstaller'
    condition: selection_event and not filter_legit_installer
fields:
    - device_id
    - user
    - package_name
    - installer_package_name
    - app_name
falsepositives:
    - Enterprise-managed wallet apps legitimately deployed via EMM without Play Store
level: high

Known false positives:

• Enterprise wallet or payment apps legitimately deployed via MDM outside Google Play
• Beta-channel sideloads pushed to tester devices by internal Android development teams

Tuning notes: Allowlist internal enterprise-distributed payment apps by package_name. If your MDM does not emit dedicated NfcDefaultPaymentHandlerChanged events, substitute setting_changed events with setting_name='default_nfc_payment_handler'. Consider correlating with a sideload-install event within the previous 15 minutes for higher precision.

• 🔒 NGate HandyPay — WhatsApp-Delivered APK Sideload on Managed Android (Exploitation) · unlock with TL Creds
• 🔒 NGate HandyPay — Trojanized HandyPay Package Detected on Android Endpoint (Post-Exploitation) · unlock with TL Creds
• 🔒 NGate HandyPay — Dual-Role Distribution+C2 Outbound Beacon (C2) · unlock with TL Creds
• 🔒 NGate HandyPay — Counterfeit Rio de Prêmios / Google Play Lure Page Visit (Exploitation) · unlock with TL Creds
• 🔒 NGate HandyPay — HCE / NFC Payment-Handler Registration From Sideloaded Package (Post-Exploitation) · unlock with TL Creds
• 🔒 NGate HandyPay — Emoji Characters in Android Malware Debug Log (C2 / LLM Fingerprint) · unlock with TL Creds
• 🔒 NGate HandyPay — Sideloaded APK Download from Counterfeit Lure (Exploitation) · unlock with TL Creds
• 🔒 NGate HandyPay — Android-UA PIN Exfiltration POST to C&C (C2) · unlock with TL Creds

Indicators of compromise

As of 2026-04-21, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-0401.

Sample indicators (3 of 21)

• IP address: 104.21.91[.]170
• Domain: protecaocartao[.]online
• File hash: 48A0DE6A43FC6E49318AD6873EA63FE325200DBC

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

Technical analysis

Once installed, the app phishes the card PIN, relays the victim's tapped EMV contactless data to an attacker-paired Android device via HandyPay's own email-linked relay, and exfiltrates the PIN separately over HTTP to a C&C that doubles as the APK distribution server, enabling ATM cashouts and fraudulent contactless purchases against at least four confirmed Brazilian victims.

On 2026-04-21, ESET researcher Lukas Stefanko disclosed a new evolution of the NGate Android malware family that departs from prior tradecraft by trojanizing the legitimate HandyPay NFC payment app instead of wrapping the open-source NFCGate tool (original 2024 Czech campaign) or paying for Malware-as-a-Service NFC relay kits such as NFU Pay or TX-NFC (used by the October 2025 PhantomCard Brazil campaign). HandyPay, available on Google Play since 2021, is a legitimate app that relays NFC payment-card data between two email-paired devices; its design requires zero Android permissions beyond default-payment-app designation, which makes it ideal cover for stealthy abuse. The unmodified HandyPay has never been available as the trojanized build on Google Play.

The operation is distributed through two lures hosted on the same server, implying a single threat actor. The first is a fake 'Rio de Prêmios' scratch-card site impersonating the legitimate Loterj-operated Rio de Janeiro state lottery; the scratch game is rigged so the victim always 'wins' R$20,000 and the 'Resgatar meu prêmio agora' button opens WhatsApp with a prefilled message to a fraudulent account whose profile image impersonates Caixa Econômica Federal — Brazil's federal bank that administers most Brazilian lotteries. Victims are then instructed to download the patched HandyPay APK as 'Rio_de_Prêmios_Pagamento.apk'. The second lure is a counterfeit Google Play product page advertising 'Proteção Cartão' (Card Protection) which delivers 'PROTECAO_CARTAO.apk' — similar naming to the October 2025 PhantomCard campaign, suggesting operator overlap or a shared playbook.

Technical execution: after the victim sideloads the APK (bypassing Android 'unknown sources' warnings), the trojanized HandyPay requests to become the default NFC payment handler — ESET confirms this is social-engineering theater because only the attacker's paired device actually needs that designation for the relay to succeed. The patched UI injects a PIN-entry box (MITRE T1417.002 GUI Input Capture) and instructs the victim to tap their contactless payment card against the phone. The legitimate HandyPay NFC-reader routine captures the EMV APDU exchange and relays it via HandyPay's own infrastructure to an attacker-operated Android device that is pre-paired via one of two hardcoded attacker email addresses observed across samples; that device can then emulate the victim's card at any NFC-capable ATM or POS terminal. Separately, the malicious patch issues an HTTP POST of the captured PIN to a dedicated C&C at 108.165.230.223, independent of HandyPay infrastructure. This same C&C server also hosts the malicious APKs and the fake Rio de Prêmios + Google Play pages, centralizing delivery and collection.

ESET's C&C analysis recovered logs from four compromised devices, all geolocated in Brazil, containing captured PINs, victim IPs, and timestamps. ESET assesses the malicious code was most probably produced with the assistance of a generative-AI / LLM, citing emoji characters left in debug log strings inside the PIN-exfiltration routine — a fingerprint typical of AI-generated text. This fits ESET's broader PromptSpy thesis that GenAI is lowering the barrier to entry for mobile-banking malware development. BleepingComputer corroborates the AI-assistance finding.

The C&C IP 108.165.230.223 is hosted by 'KAUA REIS DA SILVA trading as BattleHost' — a named Brazilian sole-trader hosting provider — providing a strong infrastructure-attribution pivot for further hunting. The distribution IP 104.21.91.170 sits on Cloudflare with the domain protecaocartao.online. Three ESET-flagged APK SHA-1 hashes (48A0DE6A43FC6E49318AD6873EA63FE325200DBC, A4F793539480677241EF312150E9C02E324C0AA2, 94AF94CA818697E1D99123F69965B11EAD9F010C) identify the Proteção Cartão and Rio de Prêmios builds; ESET detections are Android/Spy.NGate.CC and Android/Spy.NGate.CB. ESET notified the Google App Defense Alliance and HandyPay's developer, both of whom responded (Google added Play Protect detections; HandyPay opened an internal investigation). The NGate family now spans three geographic and technical phases: original NGate (Czechia, 2023-11 to 2024-03, NFCGate-based, culminated in a Prague arrest of a 22-year-old courier carrying 160,000 CZK), PhantomCard (Brazil, 2025-10, NFU Pay MaaS), and this HandyPay-trojanized variant (Brazil, 2025-11 to present).

MITRE ATT&CK techniques by tactic:

defense-evasion

T1406 Obfuscated Files or Information; T1655 Masquerading

Collection

T1409 Stored Application Data

collection

T1417 Input Capture

Discovery

T1418 Software Discovery

command-and-control

T1437 Application Layer Protocol

initial-access

T1476 Deliver Malicious App via Other Means; T1660 Phishing

Execution

T1575 Native API

Impact

T1640 Account Access Removal

Exfiltration

T1646 Exfiltration Over C2 Channel

Remediation

Patches

• No software patch applicable — this is a trojanized-app social-engineering campaign, not a CVE-style vulnerability
• Ensure Google Play Protect is enabled and up-to-date; ESET-supplied detections for Android/Spy.NGate.CC and Android/Spy.NGate.CB are active as of 2026-04-21

Immediate actions

• Block domain protecaocartao.online at DNS and web proxy tiers
• Block outbound traffic to 104.21.91.170 and 108.165.230.223 at perimeter firewalls
• Alert on any Android device attempting to install APKs with SHA-1 hashes 48A0DE6A43FC6E49318AD6873EA63FE325200DBC, A4F793539480677241EF312150E9C02E324C0AA2, or 94AF94CA818697E1D99123F69965B11EAD9F010C
• Hunt for HTTP POSTs from Android user agents to 108.165.230.223 containing short numeric payloads consistent with 4- to 6-digit PIN exfiltration
• Push mobile-device-management policy disabling installation from unknown sources on managed Android fleets
• Communicate to Brazilian customer base: reject any WhatsApp lottery-prize messages from self-declared Caixa Econômica Federal accounts; never install APKs outside Google Play

Workarounds

• Disable Android NFC when not actively making contactless payments
• Do not set any sideloaded app as the default NFC payment handler
• Enforce app installation restricted to Google Play via MDM on corporate Android devices
• For consumer banking apps targeting Brazil, add in-app warnings about lottery/prize lures using WhatsApp

Longer-term hardening

• Deploy managed mobile threat defense (MTD) with behavioral analytics — ESET Mobile Security, Lookout, or equivalent — on all employee and customer-facing Android devices
• Educate cardholders to prefer tokenized contactless payment via Google Wallet and Apple Wallet; both require per-transaction verification and defeat NFC relay
• Encourage RFID-blocking wallets and disabling NFC when not actively transacting
• Integrate ESET App Defense Alliance feed into Google Play Protect enterprise policies
• Subscribe to ESET and BleepingComputer advisories on NGate family to track future variants and MaaS expansion (NFU Pay, TX-NFC)
• Rotate card PINs for any customer observed installing sideloaded NFC-related apps

Affected and fixed versions

• Google — Android
  Vulnerable versions: 4.4+ (any Android with HCE/NFC payment support)
• HandyPay (impersonated / trojanized) — HandyPay NFC Relay App for Android
  Vulnerable versions: trojanized repackage (not the Google Play build)
  Fixed in: official HandyPay on Google Play is unaffected
• EMVCo (payment scheme) — Contactless EMV payment cards (Visa, Mastercard, Elo, Hipercard)
  Vulnerable versions: any contactless-capable EMV card tapped on a compromised device
  Fixed in: tokenized cards in Google Wallet / Apple Wallet resist relay

Timeline

• 2021-01-01 Legitimate HandyPay NFC relay app first published on Google Play by its original developer.
• 2024-03-06 Original NGate malware variant first observed in the wild in Czechia, wrapping the open-source NFCGate tool to relay NFC data from Czech banking cardholders.
• 2024-03-31 Czech police arrest a 22-year-old NGate courier in Prague carrying approximately 160,000 CZK (about USD 6,500) in cash withdrawn via relayed NFC ATM transactions.
• 2024-08-22 ESET (Lukas Stefanko and Jakub Osmani) publishes the original NGate research naming the family and documenting the NFCGate-based Czech campaign.
• 2025-10-01 PhantomCard NGate variant targets Brazilian cardholders using fake card-protection app names and the NFU Pay MaaS offering — establishing the lineage and playbook for the 2025-11 HandyPay variant.
• 2025-11-08 Distribution domain locked-ioc-6 and IP locked-ioc-9 (Cloudflare) first observed — effective start of the HandyPay-variant campaign.
• 2025-11-09 C&C IP locked-ioc-8 first observed, hosted by KAUA REIS DA SILVA trading as BattleHost (Brazil).
• 2026-04-21 ESET WeLiveSecurity publishes full disclosure of the HandyPay-trojanized NGate variant; BleepingComputer covers the same day; ESET notifies Google App Defense Alliance (Play Protect detections added) and HandyPay's developer (internal investigation confirmed); C&C logs show four Brazilian victims already compromised.
• 2026-05-29 As of 2026-05-29, this NGate HandyPay NFC-relay campaign remains ACTIVE: ESET's 2026-04-21 disclosure reported it ongoing since Nov 2025 with "no signs of stopping," C&C/distribution infra still live, and no takedown, arrest, or sinkhole. No CVE applies (social-engineering trojan); the unattributed operator is at large amid rising Brazil NFC fraud.

Sources cited

• MITRE ATT&CK for Mobile — T1660 Phishing MITRE · Advisory · 2026-04-21
• MITRE ATT&CK for Mobile — T1417.002 Input Capture: GUI Input Capture MITRE · Advisory · 2026-04-21
• MITRE ATT&CK for Mobile — T1646 Exfiltration Over C2 Channel MITRE · Advisory · 2026-04-21
• ESET Research — New NGate variant hides in a trojanized NFC payment app ESET WeLiveSecurity · Research · 2026-04-21
• ESET Research — NGate Android malware relays NFC traffic to steal cash (original 2024 Czech campaign, family lineage) ESET WeLiveSecurity · Research · 2024-08-22
• ESET GitHub — Indicators of Compromise repository GitHub · Code repository · 2026-04-21
• BleepingComputer — NGate Android malware uses HandyPay NFC app to steal card data BleepingComputer · News · 2026-04-21

Related threats

• NGate Android NFC Relay Malware Variant - Trojanized HandyPay Banking App Campaign Targeting Brazil (2025-2026)
• OverlayPhantom Android Banking Trojan — Novel Overlay-Driven Credential Theft Targeting 180+ Banking and Crypto Apps (Cyble CRIL)
• PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote Access, Chase Bank Impersonation

Previous and next in malware

• The Gentlemen Ransomware Operationalizes SystemBC SOCKS5 Botnet of 1,570+ Corporate Hosts for Double-Extortion Operations Previous report
• Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads Deliver Vidar Stealer v18.7 + GhostSocks Next report