MacSync under the microscope: new delivery methods and a new payload

Kaspersky Securelist reporting from August–September 2026 covering multiple active malware and threat campaigns, including the MacSync macOS stealer/backdoor, PAYLOAD ransomware abusing Active Directory Group Policy, MovieReaper torrent-delivered Trojans using Solana for C2 concealment, NightEagle activity against Russian organizations, Toy Ghouls backdoors using MQTT and Matrix, Mirage Kitten malware targeting aviation and FinTech, ValleyRAT distribution, industrial-control-system threats, vulnerability and exploit trends, and Android malware creating an advertising proxy botnet. The material