PromptSpy GenAI spy tool and Android infostealers fuel ATM hacks

Security Affairs Malware Newsletter Round 85, by Pierluigi Paganini, was published on 22 February 2026 and gathers a curated selection of the latest malware research from around the world. The round-up highlights several notable threats, including Ninja Browser & Lumma Infostealer, Ghost Tapped: Tracking the Rise of Chinese Tap-to-pay Android Malware, and Hudson Rock Identifies Real-World Infostealer Infection Targeting OpenClaw Configurations.

It also covers Keenadu, a new backdoor that exposed links between major Android botnets, and PromptSpy, which allegedly ushers in an era of Android threats using GenAI. Other topics listed include Android[.]Phantom Trojans infiltrating smartphones via games and pirated mods, and MIMICRAT, a custom RAT delivered through compromised legitimate websites.

The newsletter also references a rise in at least some malware-enabled ATM jackpotting incidents in the United States, alongside related analysis and research reports.