Angry Birds: Toy Ghouls’ new toys

Kaspersky Securelist RSS collection covering threat intelligence from August–September 2026. Reported activity includes new backdoors and malware families, MQTT and Matrix/Element command-and-control, adware masquerading, Android proxy botnets, industrial control system threats, kernel-level rootkits, Telegram data theft, exploitation of unpatched TrueConf servers, and covert C2 using Google Apps Script and DNS. The feed also includes a quarterly review of vulnerabilities, exploits, C2 frameworks, and emerging risks in open-source AI agents and frameworks.