MacSync under the microscope: new delivery methods and a new payload
2026-10-01T20:51:46Z•5593fe6fd1e084680d07106dee737d60f9b40aa904add02d5440b2cf651ae9c3
APTActive DirectoryAndroid malwareC2 concealmentFinTechGhostContainerGitHubGroup PolicyJavaScript malwareMQTTMatrixNode.js malwareRDP exploitationSolanaaviationbackdoorbinaryless attackcryptocurrency targetingindustrial control systemsinfostealermacOS malwareproxy botnetransomwaretorrent malwarevulnerabilities and exploits
What happened
Kaspersky Securelist feed covering recent threat research, including the MacSync macOS stealer and backdoor, PAYLOAD ransomware abusing Active Directory Group Policy, MovieReaper torrent-based Trojan campaigns using Solana for C2 concealment, NightEagle APT activity, Toy Ghouls backdoors using MQTT and Matrix, Mirage Kitten malware targeting aviation and FinTech, ValleyRAT distribution, industrial-system threats, vulnerability and exploit trends, and Android malware targeting automotive head units.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 5593fe6fd1e084680d07106dee737d60f9b40aa904add02d5440b2cf651ae9c3
- Enrichment time
- 2026-10-01T20:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.