S9040 NGate

NGate is an Android malware that was first seen in November 2023 targeting Czech banks and Polish banks. NGate uses Near Field Communication (NFC) to relay a victim’s debit card and banking information from the compromised Android device to the adversary’s device, ultimately resulting in fraudulent ATM withdrawals by the adversary. NGate uses the legitimate tool called NFCGate, developed by students at the Technical University of Darmstadt, Germany. A new variant of NGate that abuses the legitimate application HandyPay, potentially with AI-generated code, has been observed targeting users in Brazil since at least November 2025. This variant is capable of performing NFC transfers like previous iterations with new functionality for capturing and exfiltrating the victim’s payment card PIN.