New NGate variant hides in a trojanized NFC payment app
2026-04-22T08:51:39Z•7ac083488735e9975d1bdfe8794deab5b8131edecb52fbd7c6058edf313d0543
APTAndroidDynoWiperEDR-killerGenAINFCNGatePromptSpySandwormcloud-securitymalwaremobile-paymentsphishingransomwarescamssupply-chaintrojanvulnerable-driverswiper
What happened
ESET research highlights multiple active and evolving threats: a new NGate variant distributed via a trojanized NFC payment app (potentially AI-assisted), the emergence of GenAI-enabled Android malware (PromptSpy), abuse of vulnerable drivers in the EDR-killer ecosystem, and destructive wipers (DynoWiper) with Sandworm attribution. Coverage also details targeted campaigns (Silver Fox, Sednit resurgence), ransomware extortion tactics, and persistent phishing/scam trends—underscoring elevated risk to mobile payments, cloud workloads, and supply-chain/third-party dependencies.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- eset_welivesecurity
- Record identifier
- 7ac083488735e9975d1bdfe8794deab5b8131edecb52fbd7c6058edf313d0543
- Enrichment time
- 2026-04-22T08:51:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.