The malicious updates delivered through NoxPlayer’s compromised update mechanism included an unknown malware with monitoring capabilities and the extensively used Gh0st remote access trojan (RAT).