Angry Birds: Toy Ghouls’ new toys

Kaspersky Securelist reporting from August–September 2026 covers multiple active cyberespionage and malware campaigns, including Toy Ghouls backdoors using MQTT and Matrix/Element for C2, Mirage Kitten malware targeting aviation and FinTech in the Middle East and Africa, ValleyRAT delivered as adware, HoneyMyte’s kernel-level CoolClient rootkit, Armored Likho’s Telegram-stealing toolkit, Head Mare exploitation of unpatched TrueConf servers, and Project CAV3RN using Google Apps Script and DNS-based C2. Additional reporting addresses Android proxy botnet malware, industrial control system threat