MacSync under the microscope: new delivery methods and a new payload
2026-10-10T20:51:46Z•474932f087d832c0d725aea07143c58250356c0581b38823070c9a58ebdbc0af
APTActive DirectoryAndroid malwareElement messengerGitHub abuseGroup Policy ObjectsJavaScript malwareMQTT C2Node.js malwareRDP exploitationadware masqueradingbackdoorblockchain C2cryptocurrency targetingindustrial control systemsinfostealerliving off the landmacOS malwareproxy botnetransomwaretorrent malwarevulnerability intelligence
What happened
Kaspersky Securelist entries describe multiple 2026 threat campaigns, including the MacSync macOS stealer with a backdoor targeting cryptocurrency users and developers; PAYLOAD ransomware abusing Active Directory Group Policy Objects for binary-less encryptionless attacks; MovieReaper distributed through compromised movie torrents with Solana-based C2 concealment; NightEagle using GhostContainer, GitHub-hosted tools, and Active Directory/RDP exploitation; Toy Ghouls backdoors using MQTT and Element for command and control; Mirage Kitten malware targeting aviation and FinTech in the Middle East
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 474932f087d832c0d725aea07143c58250356c0581b38823070c9a58ebdbc0af
- Enrichment time
- 2026-10-10T20:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.