MacSync under the microscope: new delivery methods and a new payload

Kaspersky Securelist reporting from August–September 2026 covers diverse malware and threat campaigns, including the MacSync macOS stealer/backdoor, PAYLOAD ransomware abusing Active Directory Group Policy, MovieReaper distributed through compromised torrents with Solana-based C2 concealment, NightEagle targeting Russian organizations via GhostContainer and AD/RDP exploitation, Toy Ghouls backdoors using MQTT and Element, Mirage Kitten malware targeting aviation and FinTech in the Middle East and Africa, ValleyRAT disguised as adware, Android proxy-botnet malware in vehicle head units, and Q2