Angry Birds: Toy Ghouls’ new toys

Kaspersky reporting from August–September 2026 describes multiple emerging malware campaigns and threat actor toolsets, including Toy Ghouls backdoors using MQTT and Matrix/Element for command and control, Mirage Kitten malware targeting aviation and FinTech in the Middle East and Africa, ValleyRAT distributed as adware, Android proxy-botnet malware on automotive head units, and HoneyMyte’s kernel-level CoolClient rootkit. Additional activity includes Telegram-focused espionage, exploitation of unpatched TrueConf servers, and Project CAV3RN’s use of Google Apps Script and DNS-based C2. The set