Webworm: New burrowing techniques

A collection of ESET WeLiveSecurity publications from Mar–May 2026 describing active offensive campaigns, new APT tooling and techniques, and high-impact malware. Notable research covers Webworm’s new burrowing techniques, updates to FrostyNeighbor’s compromise chain, the discovery of GopherWhisper (a China‑aligned APT targeting Mongolian institutions), a ScarCruft supply‑chain attack against gaming platforms, a trojanized NFC payment app delivering a new NGate variant, PromptSpy (first‑known Android malware abusing generative AI), large‑scale fraudulent Android apps (CallPhantom) removed from