MacSync under the microscope: new delivery methods and a new payload

Kaspersky Securelist reporting from August–September 2026 covers multiple active malware and threat actor campaigns, including macOS information theft, ransomware abuse of Active Directory Group Policy, torrent-delivered Trojans using Solana for C2 concealment, APT activity against Russian organizations, MQTT and Matrix-based backdoors, Middle East and Africa targeting, ValleyRAT distribution, industrial-control-system threats, vulnerability trends, and Android proxy-botnet malware targeting automotive head units. The feed is threat-intelligence reporting rather than a single incident and does