Angry Birds: Toy Ghouls’ new toys

Kaspersky reporting highlights multiple 2026 campaigns involving backdoors, espionage tooling, rootkits, malware delivery through legitimate software, and exploitation of unpatched servers. Notable activity includes Toy Ghouls using MQTT and Matrix/Element for command and control, Mirage Kitten deploying Node.js and JavaScript malware against aviation and FinTech organizations, HoneyMyte deploying a kernel-level rootkit, and Head Mare exploiting an unpatched TrueConf server. Project CAV3RN uses Google Apps Script and DNS-based routing to conceal C2 traffic.