The invisible passenger in your car

Kaspersky Securelist reporting from July–August 2026 covering Android head-unit malware used for advertising and proxy botnet activity; a HoneyMyte CoolClient variant with a kernel-level Windows rootkit; Armored Likho cyber-espionage targeting Telegram data and audio; Head Mare exploitation of unpatched TrueConf servers to deploy PhantomCore and PhantomGraph; Project CAV3RN using Google Apps Script and DNS-based C2; MFA-bypassing adversary-in-the-middle phishing hosted on legitimate cloud platforms; and broader malware, incident-response, Kerberoasting, and DNS-tunneling trends.