[NGate](https://attack.mitre.org/software/S9040) is an Android malware that was first seen in November 2023 targeting Czech banks and Polish banks. [NGate](https://attack.mitre.org/software/S9040) uses Near Field Communication (NFC) to relay a victim’s debit card and banking information from the compromised Android device to the adversary’s device, ultimately resulting in fraudulent ATM withdrawals by the adversary. [NGate](https://attack.mitre.org/software/S9040) uses the legitimate tool called NFCGate, developed by students at the Technical University of Darmstadt, Germany.(Citation: ESETStefankoOsmani_NGate_Aug2024)(Citation: CERTPL_NGate_Nov2025) A new variant of [NGate](https://attack.mitre.org/software/S9040) that abuses the legitimate application HandyPay, potentially with AI-generated code, has been observed targeting users in Brazil since at least November 2025. This variant is capable of performing NFC transfers like previous iterations with new functionality for capturing and exfiltrating the victim’s payment card PIN.(Citation: ESETStefanko_NGateVariant_Apr2026)
Platforms: Android
MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.