# NGate Android Malware — HandyPay-Trojanized NFC Relay Variant Targets Brazilian Cardholders via Fake Rio de Prêmios Lottery and Counterfeit Google Play Lures

> ESET Research disclosed on 2026-04-21 a new NGate Android malware variant that abandons the open-source NFCGate relay tool and instead trojanizes the legitimate HandyPay NFC payment app. Active since 2025-11-08, the campaign targets Brazilian cardholders through a fake Rio de Prêmios lottery scratch-card website and a counterfeit Google Play page for a bogus 'Proteção Cartão' app, with WhatsApp used as a pivot to deliver APKs. Once installed, the app phishes the card PIN, relays the victim's tapped EMV contactless data to an attacker-paired Android device via HandyPay's own email-linked relay, and exfiltrates the PIN separately over HTTP to a C&C that doubles as the APK distribution server, enabling ATM cashouts and fraudulent contactless purchases against at least four confirmed Brazilian victims.

- **Published:** 2026-04-21T12:00:00Z
- **Last reviewed:** 2026-04-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0401
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-ngate-handypay-variant-tl-2026-0401.webp?v=822a771f (Threadlinqs threat intel: NGate Brazil Lottery Lure Steals PINs: Detection & IOCs (TL-2026-0401) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-0401
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

On 2026-04-21, ESET researcher Lukas Stefanko disclosed a new evolution of the NGate Android malware family that departs from prior tradecraft by trojanizing the legitimate HandyPay NFC payment app instead of wrapping the open-source NFCGate tool (original 2024 Czech campaign) or paying for Malware-as-a-Service NFC relay kits such as NFU Pay or TX-NFC (used by the October 2025 PhantomCard Brazil campaign). HandyPay, available on Google Play since 2021, is a legitimate app that relays NFC payment-card data between two email-paired devices; its design requires zero Android permissions beyond default-payment-app designation, which makes it ideal cover for stealthy abuse. The unmodified HandyPay has never been available as the trojanized build on Google Play.

The operation is distributed through two lures hosted on the same server, implying a single threat actor. The first is a fake 'Rio de Prêmios' scratch-card site impersonating the legitimate Loterj-operated Rio de Janeiro state lottery; the scratch game is rigged so the victim always 'wins' R$20,000 and the 'Resgatar meu prêmio agora' button opens WhatsApp with a prefilled message to a fraudulent account whose profile image impersonates Caixa Econômica Federal — Brazil's federal bank that administers most Brazilian lotteries. Victims are then instructed to download the patched HandyPay APK as 'Rio_de_Prêmios_Pagamento.apk'. The second lure is a counterfeit Google Play product page advertising 'Proteção Cartão' (Card Protection) which delivers 'PROTECAO_CARTAO.apk' — similar naming to the October 2025 PhantomCard campaign, suggesting operator overlap or a shared playbook.

Technical execution: after the victim sideloads the APK (bypassing Android 'unknown sources' warnings), the trojanized HandyPay requests to become the default NFC payment handler — ESET confirms this is social-engineering theater because only the attacker's paired device actually needs that designation for the relay to succeed. The patched UI injects a PIN-entry box (MITRE T1417.002 GUI Input Capture) and instructs the victim to tap their contactless payment card against the phone. The legitimate HandyPay NFC-reader routine captures the EMV APDU exchange and relays it via HandyPay's own infrastructure to an attacker-operated Android device that is pre-paired via one of two hardcoded attacker email addresses observed across samples; that device can then emulate the victim's card at any NFC-capable ATM or POS terminal. Separately, the malicious patch issues an HTTP POST of the captured PIN to a dedicated C&C at 108.165.230.223, independent of HandyPay infrastructure. This same C&C server also hosts the malicious APKs and the fake Rio de Prêmios + Google Play pages, centralizing delivery and collection.

ESET's C&C analysis recovered logs from four compromised devices, all geolocated in Brazil, containing captured PINs, victim IPs, and timestamps. ESET assesses the malicious code was most probably produced with the assistance of a generative-AI / LLM, citing emoji characters left in debug log strings inside the PIN-exfiltration routine — a fingerprint typical of AI-generated text. This fits ESET's broader PromptSpy thesis that GenAI is lowering the barrier to entry for mobile-banking malware development. BleepingComputer corroborates the AI-assistance finding.

The C&C IP 108.165.230.223 is hosted by 'KAUA REIS DA SILVA trading as BattleHost' — a named Brazilian sole-trader hosting provider — providing a strong infrastructure-attribution pivot for further hunting. The distribution IP 104.21.91.170 sits on Cloudflare with the domain protecaocartao.online. Three ESET-flagged APK SHA-1 hashes (48A0DE6A43FC6E49318AD6873EA63FE325200DBC, A4F793539480677241EF312150E9C02E324C0AA2, 94AF94CA818697E1D99123F69965B11EAD9F010C) identify the Proteção Cartão and Rio de Prêmios builds; ESET detections are Android/Spy.NGate.CC and Android/Spy.NGate.CB. ESET notified the Google App Defense Alliance and HandyPay's developer, both of whom responded (Google added Play Protect detections; HandyPay opened an internal investigation). The NGate family now spans three geographic and technical phases: original NGate (Czechia, 2023-11 to 2024-03, NFCGate-based, culminated in a Prague arrest of a 22-year-old courier carrying 160,000 CZK), PhantomCard (Brazil, 2025-10, NFU Pay MaaS), and this HandyPay-trojanized variant (Brazil, 2025-11 to present).

## MITRE ATT&CK

- T1660 Phishing
- T1476 Deliver Malicious App via Other Means
- T1575 Native API
- T1655 Masquerading
- T1406 Obfuscated Files or Information
- T1417 Input Capture
- T1418 Software Discovery
- T1409 Stored Application Data
- T1437 Application Layer Protocol
- T1646 Exfiltration Over C2 Channel
- T1640 Account Access Removal

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**NGate HandyPay — Default NFC Payment Handler Change on Sideloaded App (Post-Exploitation)** (`TL-2026-0401-SPL-002`)

Detects a non-Google-Play-origin Android application being designated (or requesting designation as) the default NFC/HCE payment handler — the social-engineering step the trojanized HandyPay uses to complete the relay setup. Targets MDM/UEM and Android endpoint event streams that report sideload-install provenance and NFC default-payment-handler changes.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1655.001, T1417.002, T1418
- **Data sources:** mdm, intune, workspace_one, mobileiron, mde_mobile
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=mdm sourcetype IN ("intune:android","workspaceone:android","mobileiron:events") earliest=-24h@h
| search (event_name="NfcDefaultPaymentHandlerChanged" OR event_name="DefaultPaymentApplicationChanged" OR setting_name="default_nfc_payment_handler" OR permission="android.permission.NFC_PAYMENT_DEFAULT")
| eval install_source=coalesce(install_source, installer_package_name, source)
| where install_source!="com.android.vending" AND install_source!="com.google.android.packageinstaller"
| stats count values(package_name) as packages values(install_source) as install_sources values(app_name) as app_names min(_time) as first_seen max(_time) as last_seen by device_id user
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%S")
| table user device_id packages app_names install_sources first_seen last_seen count
```

### Microsoft KQL

```kql
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("NfcDefaultPaymentHandlerChanged","DefaultPaymentApplicationChanged","AppInstalled")
| extend Parsed=parse_json(AdditionalFields)
| extend InstallSource=tostring(Parsed.InstallerPackageName), PackageName=tostring(Parsed.PackageName), AppName=tostring(Parsed.AppName)
| where (ActionType == "NfcDefaultPaymentHandlerChanged" and InstallSource !in ("com.android.vending","com.google.android.packageinstaller")) or (ActionType == "AppInstalled" and InstallSource !in ("com.android.vending","com.google.android.packageinstaller") and PackageName has_any ("handypay","protecao","premios"))
| project Timestamp, DeviceName, DeviceId, AccountName, PackageName, AppName, InstallSource, ActionType
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Packages=make_set(PackageName), Sources=make_set(InstallSource) by DeviceId, AccountName
```

### Sigma

```yaml
title: Sideloaded Android App Becomes Default NFC Payment Handler
id: 7a1e2c80-0401-4002-bbbb-ngatehp2026
status: experimental
description: Detects an Android app whose installer is not Google Play being designated as the default NFC/HCE payment handler — NGate HandyPay social-engineering signature.
references:
    - https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/
    - https://attack.mitre.org/techniques/T1655/001/
author: Threadlinqs Team
date: 2026/04/21
tags:
    - attack.defense_evasion
    - attack.credential_access
    - attack.t1655.001
    - attack.t1417.002
logsource:
    product: mdm
    category: device_event
detection:
    selection_event:
        event_name:
            - 'NfcDefaultPaymentHandlerChanged'
            - 'DefaultPaymentApplicationChanged'
    filter_legit_installer:
        installer_package_name:
            - 'com.android.vending'
            - 'com.google.android.packageinstaller'
    condition: selection_event and not filter_legit_installer
fields:
    - device_id
    - user
    - package_name
    - installer_package_name
    - app_name
falsepositives:
    - Enterprise-managed wallet apps legitimately deployed via EMM without Play Store
level: high
```

**Known false positives:**

- Enterprise wallet or payment apps legitimately deployed via MDM outside Google Play
- Beta-channel sideloads pushed to tester devices by internal Android development teams

**Tuning notes:** Allowlist internal enterprise-distributed payment apps by package_name. If your MDM does not emit dedicated NfcDefaultPaymentHandlerChanged events, substitute setting_changed events with setting_name='default_nfc_payment_handler'. Consider correlating with a sideload-install event within the previous 15 minutes for higher precision.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- NGate HandyPay — WhatsApp-Delivered APK Sideload on Managed Android (Exploitation) (locked: unlock with TL Creds)
- NGate HandyPay — Trojanized HandyPay Package Detected on Android Endpoint (Post-Exploitation) (locked: unlock with TL Creds)
- NGate HandyPay — Dual-Role Distribution+C2 Outbound Beacon (C2) (locked: unlock with TL Creds)
- NGate HandyPay — Counterfeit Rio de Prêmios / Google Play Lure Page Visit (Exploitation) (locked: unlock with TL Creds)
- NGate HandyPay — HCE / NFC Payment-Handler Registration From Sideloaded Package (Post-Exploitation) (locked: unlock with TL Creds)
- NGate HandyPay — Emoji Characters in Android Malware Debug Log (C2 / LLM Fingerprint) (locked: unlock with TL Creds)
- NGate HandyPay — Sideloaded APK Download from Counterfeit Lure (Exploitation) (locked: unlock with TL Creds)
- NGate HandyPay — Android-UA PIN Exfiltration POST to C&C (C2) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `104.21.91[.]170`
- Domain: `protecaocartao[.]online`
- File hash: `48A0DE6A43FC6E49318AD6873EA63FE325200DBC`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ESET Research — New NGate variant hides in a trojanized NFC payment app](https://www.welivesecurity.com/en/eset-research/new-ngate-variant-hides-in-a-trojanized-nfc-payment-app/)
- [BleepingComputer — NGate Android malware uses HandyPay NFC app to steal card data](https://www.bleepingcomputer.com/news/security/ngate-android-malware-uses-handypay-nfc-app-to-steal-card-data/)
- [ESET Research — NGate Android malware relays NFC traffic to steal cash (original 2024 Czech campaign, family lineage)](https://www.welivesecurity.com/en/eset-research/ngate-android-malware-relays-nfc-traffic-to-steal-cash/)
- [ESET GitHub — Indicators of Compromise repository](https://github.com/eset/malware-ioc)
- [MITRE ATT&CK for Mobile — T1660 Phishing](https://attack.mitre.org/techniques/T1660/)
- [MITRE ATT&CK for Mobile — T1417.002 Input Capture: GUI Input Capture](https://attack.mitre.org/techniques/T1417/002/)
- [MITRE ATT&CK for Mobile — T1646 Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1646/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0401