Angry Birds: Toy Ghouls’ new toys

Kaspersky Securelist reporting from August–September 2026 describes multiple targeted campaigns and malware developments, including Toy Ghouls backdoors using HiveMQ MQTT and Matrix/Element for command and control; Mirage Kitten malware targeting aviation and FinTech in the Middle East and Africa; ValleyRAT distributed as adware; Android head-unit malware forming an advertising and proxy botnet; HoneyMyte’s CoolClient with a kernel-level rootkit; Armored Likho’s Telegram-stealing Still Toolkit; Head Mare exploitation of unpatched TrueConf servers; and Project CAV3RN using Google Apps Script,‍a