MacSync under the microscope: new delivery methods and a new payload

Kaspersky Securelist entries from August–September 2026 describe multiple malware and intrusion campaigns, including the MacSync macOS stealer with a backdoor targeting cryptocurrency users and developers; PAYLOAD ransomware abusing Active Directory Group Policy in a binary-less, encryptionless operation; MovieReaper distributed through compromised movie torrents with Solana-based C2 concealment; NightEagle activity using GhostContainer, GitHub-hosted tools, Active Directory and RDP exploitation; Toy Ghouls backdoors using HiveMQ MQTT and Element; Mirage Kitten malware targeting aviation and,1