MacSync under the microscope: new delivery methods and a new payload

Kaspersky Securelist reporting from August–September 2026 covers multiple active malware campaigns and threat groups, including the MacSync macOS stealer with a backdoor targeting cryptocurrency users and developers; PAYLOAD ransomware abusing Active Directory Group Policy in a binary-less, encryptionless operation; MovieReaper malware distributed through compromised torrents with Solana-based C2 concealment; NightEagle activity using GhostContainer, GitHub-hosted tools, AD and RDP exploitation; Toy Ghouls backdoors using MQTT and Matrix/Element for C2; Mirage Kitten malware targeting aviation