MacSync under the microscope: new delivery methods and a new payload

Kaspersky Securelist reporting from August–September 2026 covers macOS infostealers and backdoors, ransomware abuse of Active Directory Group Policy, torrent-delivered malware using Solana for command-and-control concealment, APT campaigns exploiting AD and RDP, MQTT and Matrix-based backdoors, sector-targeted malware, adware masquerading as ValleyRAT, industrial-control threats, vulnerability and exploit trends including AI frameworks, and Android malware forming an advertising proxy botnet. The collection reflects high-impact activity across endpoint, identity, cloud/communications, OT, and—