The invisible passenger in your car

Kaspersky Securelist reporting from July–August 2026 covers Android malware distributed through legitimate DoFun head-unit software to serve advertisements and create a proxy botnet; HoneyMyte’s CoolClient backdoor with a kernel-level Windows rootkit; Armored Likho espionage using the Still Toolkit to steal Telegram data and eavesdrop; Head Mare exploitation of unpatched TrueConf servers to deploy PhantomCore and PhantomGraph; Project CAV3RN using Google Apps Script relays and DNS-based C2 selection; phishing campaigns abusing legitimate cloud platforms to bypass MFA; and broader malware, APT,