MacSync under the microscope: new delivery methods and a new payload
2026-10-15T20:51:46Z•b100032b87f3b2bd98c10a78c5758394b1c506b21c8a739dd0a1827ca8d2189b
APTActive DirectoryAndroid malwareElement messengerGitHub-hosted malwareGroup Policy ObjectsICS threatsJavaScript malwareMQTT C2Node.js malwareRDP exploitationSolanaadware masqueradingbackdoorbinaryless attackcryptocurrency targetingindustrial control systemsinfostealermacOS malwareproxy botnetransomwaretorrent malwarevulnerability exploitation
What happened
Kaspersky Securelist RSS entries from August–September 2026 covering macOS information stealers, ransomware abusing Active Directory Group Policy, torrent-delivered Trojans using Solana for C2 concealment, APT activity, modular backdoors, phishing and adware masquerading, industrial control system threats, vulnerability trends, and Android proxy-botnet malware. The collection reflects significant enterprise, developer, cryptocurrency, aviation, financial, and industrial-sector risk, but provides no specific CVE identifiers.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- b100032b87f3b2bd98c10a78c5758394b1c506b21c8a739dd0a1827ca8d2189b
- Enrichment time
- 2026-10-15T20:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.