MacSync under the microscope: new delivery methods and a new payload

Kaspersky Securelist RSS entries describe multiple 2026 threat campaigns, including macOS information theft and backdoor activity, ransomware abuse of Active Directory Group Policy, torrent-delivered malware using Solana for C2 concealment, APT operations exploiting AD and RDP, MQTT- and Element-based backdoors, targeted malware against aviation and FinTech, ValleyRAT distribution, industrial-control threats, vulnerability and exploit trends including AI frameworks, and Android malware forming an advertising proxy botnet. No specific CVE identifiers are provided in the supplied metadata.