GopherWhisper: A burrow full of malware

2026-04-24T08:51:39Z18d26f676648dc141144a6615618dd7152bb2b7016532bdb27a734049cb59e43
AI‑assisted malwareAPTAndroid spywareChina‑alignedDynoWiperEDR killersGopherWhisperMongoliaNFC paymentNGatePakistanPromptSpySandwormSednitSilver Foxcloud workload securitydata‑wipergenerative AImobile malwareransomwaresupply chain risktargeted espionagetrojanized appvulnerable drivers

What happened

ESET’s WeLiveSecurity stream (Apr 2026) highlights multiple high-impact threat developments: the discovery of a new China‑aligned APT dubbed “GopherWhisper” targeting Mongolian government institutions; a new NGate malware variant hidden inside a trojanized NFC payment app (possibly leveraging AI assistance); PromptSpy — the first known Android malware to incorporate generative‑AI in its execution flow; and renewed destructive operations (DynoWiper) attributed to Sandworm against critical infrastructure. Additional research covers EDR‑killer techniques that abuse vulnerable drivers, resurgent A

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
eset_welivesecurity
Record identifier
18d26f676648dc141144a6615618dd7152bb2b7016532bdb27a734049cb59e43
Enrichment time
2026-04-24T08:51:39Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

Record · GopherWhisper: A burrow full of malware · Baitaphish