GopherWhisper: A burrow full of malware
2026-04-24T08:51:39Z•18d26f676648dc141144a6615618dd7152bb2b7016532bdb27a734049cb59e43
AI‑assisted malwareAPTAndroid spywareChina‑alignedDynoWiperEDR killersGopherWhisperMongoliaNFC paymentNGatePakistanPromptSpySandwormSednitSilver Foxcloud workload securitydata‑wipergenerative AImobile malwareransomwaresupply chain risktargeted espionagetrojanized appvulnerable drivers
What happened
ESET’s WeLiveSecurity stream (Apr 2026) highlights multiple high-impact threat developments: the discovery of a new China‑aligned APT dubbed “GopherWhisper” targeting Mongolian government institutions; a new NGate malware variant hidden inside a trojanized NFC payment app (possibly leveraging AI assistance); PromptSpy — the first known Android malware to incorporate generative‑AI in its execution flow; and renewed destructive operations (DynoWiper) attributed to Sandworm against critical infrastructure. Additional research covers EDR‑killer techniques that abuse vulnerable drivers, resurgent A
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- eset_welivesecurity
- Record identifier
- 18d26f676648dc141144a6615618dd7152bb2b7016532bdb27a734049cb59e43
- Enrichment time
- 2026-04-24T08:51:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.