Threat landscape for industrial automation systems. Q2 2026

Kaspersky Securelist RSS collection covering Q2 2026 threat trends and multiple targeted campaigns. Highlights include industrial-control-system threats, vulnerabilities and exploits—including open-source AI agents—Android malware targeting vehicle head units, a kernel-level rootkit added to the HoneyMyte CoolClient backdoor, Armored Likho espionage tooling, Head Mare exploitation of unpatched TrueConf servers, Google Apps Script and DNS-based C2, mobile banking malware, and cloud-hosted adversary-in-the-middle phishing used to bypass MFA. The collection describes active exploitation, stealth,