Angry Birds: Toy Ghouls’ new toys

Kaspersky Securelist reporting from August–September 2026 describes multiple active threat campaigns and malware developments, including Toy Ghouls backdoors using MQTT and Matrix/Element for command and control; Mirage Kitten malware targeting aviation and FinTech in the Middle East and Africa; ValleyRAT distributed as adware; Android malware creating an advertising and proxy botnet; HoneyMyte’s CoolClient with a kernel-level rootkit; Armored Likho’s Telegram-stealing Still Toolkit; Head Mare exploiting unpatched TrueConf servers; and Project CAV3RN using Google Apps Script and DNS-based C2.