Angry Birds: Toy Ghouls’ new toys

Kaspersky Securelist reporting from August–September 2026 describes multiple cyber threats, including Toy Ghouls backdoors using MQTT and Matrix/Element for command and control; Mirage Kitten malware targeting aviation and FinTech in the Middle East and Africa; ValleyRAT distributed as adware; Android malware building an advertising proxy botnet; HoneyMyte’s CoolClient with a kernel-level rootkit; Armored Likho espionage targeting Telegram data; Head Mare exploitation of unpatched TrueConf servers; and Project CAV3RN using Google Apps Script and DNS-based C2 evasion. The feed also includes Q2