New NFC malware NGate disguised as payment app

New NFC Malware NGate Disguised as App for Embedded Payment on Android

Using malware to rob money through NFC (Near Field Connection) is not new, but it is always dangerous because it can lose a lot of money quickly, and this time malware has returned.

According to a report by the website Help Net Security, it has mentioned the detection of a malware distribution campaign of the victim's money-sucking type, or the NGage-family Banking Trojan, a malware family that sucks data from the victim's credit card through NFC scanning on the victim's mobile phone to send data to the hacker's data receiver and then swipe the card at the point of purchase (PoS or Point of Sale) as easily as the card itself, called NFC Relay, which a research team from ESET, a well-known antivirus developer, has revealed that the malware is spread by embedded in a payment application. An NFC Relay called HandyPay, which is usually used to share credit cards and debits correctly. This application has been available for download on the Google Play app store since 2021. The campaign has been focused on mobile phone users using the Android operating system in Brazil since the late 2025.

The reason why malware uses embedded to use HandyPay features is that the research team revealed that the hackers behind it are trying to save costs, because the NFC Relay tools used in malware developers are often sold on the black market as malware rental (MaaS or Malware-as-a-Service) with relatively high fees per month, such as NFC Pay with rents of US $400 per month (Baht 13,005.60), and TX-NFC has rents of US $500 per month (Baht 16,257), while the HandyPay app only asks for donations of €9.99 (380.27). Baht) per month only. In addition to this, no permissions have been requested on board. Just set it up as a default payment application (Default Payment App). It is appropriate to use it as an intermediary for malware insertion.

For the malware code that was inserted into the application, the research team found that there was an Emoji in the string value. The Log made it possible to expect that the hackers behind it had used an artificial intelligence or AI in the large language model (LLM or Large Language Model) to help write the malware code, as well as to show that the hackers who used AI to write malware code were not well versed in programming because they had discarded the unique elements of content. That was created with AI left behind.

As for the campaign used to spread malware, the research team found that hackers used two methods. The first was to use the fake website of Rio de Prêmios, the lottery organization of Rio de Janeiro, which, after the victim entered the site, persuaded the victim to play a card game set for the victim to win 20,000 Brazilian reals every time he played, so that the victim pressed the Claim Reward button, which, after pressing the button, took the victim to the WhatsApp chat application, which account. The account of a hacker impersonating a Brazilian government bank called Caixa Econômica Federal to trick the victim into downloading a HandyPay application with malware in an APK file format impersonating the Rio de Prêmios application, while another method would be to use a fake Google Play page to trick the victim into downloading and installing an app called Proteão Cartão, an application that claims to strengthen credit card security from a name that can be translated as Card Protection. The fake app will come in an APK file format where the victim has to install it on board, which is an installation in Side- Loading

After the victim has installed these applications to the machine, the malware latent application will notify the default NFC payment application. It will then request the victim to enter the PIN code of the victim's card and have the victim tap the card with the NFC enabled machine. The malware will read the card data directly to the hacker's receiver to implement the card, while the PIN number will be sent to the C2 or Command and Control server via the HTTP protocol. The server will be the same as the fake application file store. Insert such malware.

# Trending # Lemon 8 Howtoo # lemon 8 diary # nfc # freedomhack