MacSync under the microscope: new delivery methods and a new payload

Kaspersky Securelist reporting from August–September 2026 describes multiple active malware and threat campaigns, including the MacSync macOS stealer with a backdoor targeting cryptocurrency users and developers; PAYLOAD ransomware abusing Active Directory Group Policy in a binary-less, encryptionless operation; MovieReaper distributed through compromised movie torrents and using Solana for C2 concealment; NightEagle activity involving GhostContainer, GitHub-hosted tools, Active Directory and RDP exploitation; Toy Ghouls backdoors using HiveMQ MQTT and Matrix Element for command and control; .