NGate
NGate is an Android malware that was first seen in November 2023 targeting Czech banks and Polish banks. NGate uses Near Field Communication (NFC) to relay a victim’s debit card and banking information from the compromised Android device to the adversary’s device, ultimately resulting in fraudulent ATM withdrawals by the adversary. NGate uses the legitimate tool called NFCGate, developed by students at the Technical University of Darmstadt, Germany.[1][2]
A new variant of NGate that abuses the legitimate application HandyPay, potentially with AI-generated code, has been observed targeting users in Brazil since at least November 2025. This variant is capable of performing NFC transfers like previous iterations with new functionality for capturing and exfiltrating the victim’s payment card PIN.[3]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Mobile | T1437 | Application Layer Protocol |
NGate has used TCP sockets to communicate with the C2 server.[2] |
|
| .001 | Web Protocols |
NGate has used TLS to communicate with the C2 server.[2] NGate has also used HTTP to communicate with the C2 server.[3] |
||
| Mobile | T1623 | Command and Scripting Interpreter |
NGate has used Java to execute a variety of actions, such as loading and verifying runtime configuration and disabling the launcher if decryption or parsing failed.[2] |
|
| Mobile | T1476 | Deliver Malicious Application via Other Means |
NGate has been distributed via files[.]fm and through fake websites that mimic legitimate services, such as banking websites and Rio de Prêmios, a lottery website.[1][2][3] |
|
| Mobile | T1646 | Exfiltration Over C2 Channel |
NGate has exfiltrated the victim’s payment card PIN to the C2 server via HTTP.[3] |
|
| Mobile | T1417 | .002 | Input Capture: GUI Input Capture |
NGate has displayed a fake website to collect the user’s banking information.[1] |
| Mobile | T1655 | .001 | Masquerading: Match Legitimate Name or Location |
NGate has used a WhatsApp profile image that impersonated Caixa Econômica Federal, Brazil’s government-owned bank that manages majority of lotteries.[3] |
| Mobile | T1406 | Obfuscated Files or Information |
NGate has decrypted ASCII-hex data from the |
|
| Mobile | T1644 | Out of Band Data |
NGate has used NFC to send the victim's card information through a server to an adversary-controlled device.[1][2][3] |
|
| Mobile | T1660 | Phishing |
NGate has been delivered using malicious links from phishing emails and SMS messages as well as malicious websites that mimic Czech banks.[1][2] NGate has also been distributed through a website impersonating a Brazilian lottery ("Rio de Prêmios") and a fake Google Play web page ("Proteção Cartão").[3] |
|
| Mobile | T1421 | System Network Connections Discovery |
NGate has requested for the |
|