Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set

Kaspersky Securelist reporting from August–September 2026 describes multiple active malware and APT campaigns, including Mirage Kitten’s NodeRabbit and PollCat malware targeting aviation and FinTech in the Middle East and Africa; ValleyRAT distributed as adware; Android malware creating an advertising and proxy botnet through DoFun head units; HoneyMyte’s CoolClient with a kernel-level rootkit; Armored Likho’s Telegram-stealing and eavesdropping toolkit; Head Mare exploiting unpatched TrueConf servers to deploy PhantomCore and PhantomGraph; and Project CAV3RN using Google Apps Script relays, .