ToxicPanda on DanSec Daily

Cybersecurity Brief – 2026-08-24

Mon, 24 Aug 2026 00:00:00 +0000

Notable Threat Actor Activity

The ToxicPanda Android malware has expanded its capabilities, now targeting 349 applications and supporting 167 remote commands. It abuses VPN permissions to block access to Google Play, hindering users from downloading security updates or alternative apps ^[1].

Trends, Tools, or Tactics of Interest

DOUBLECUP malware has been observed using PNG payloads. Despite initial claims, it does not employ genuine steganography techniques but rather hides malicious code in plain data within PNG files ^[2].
Anthropic has expanded access to its Mythos 5 security platform, which now includes codebase scanning for Claude Enterprise customers. The company also announced a 35 million USD open source fund aimed at supporting security initiatives ^[4].

Sources

ToxicPanda Android malware uses VPN permissions to block Google Play - bleepingcomputer.com
DOUBLECUP's PNG Payload, (Mon, Aug 24th) - isc.sans.edu
Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund - securityweek.com

Cybersecurity Brief – 2026-08-23

Sun, 23 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

A supply-chain attack has compromised Android-based car head units by leveraging a legitimate device-update application to distribute malware. The infected devices are conscripted into a proxy botnet or used for ad fraud operations ^[2].

Newly Discovered Vulnerabilities

Weak access controls on Windows named pipes have been highlighted as a security risk, with the potential for untrusted processes to access privileged services if proper endpoint verification and command authentication are not enforced ^[3].

Notable Threat Actor Activity

Active campaigns involving banking trojans have been observed, including the spyware-equipped Manic trojan, a persistent Grandoreiro campaign targeting Latin America and Europe, and an expanded deployment of ToxicPanda 2.0 malware ^[5].

Regulatory or Policy Developments Affecting the Security Industry

TikTok has agreed to pay a $400 million settlement to resolve a US Department of Justice lawsuit alleging violations of child privacy laws in the United States ^[1].

Sources

Hackers infect Android car head units with proxy botnet malware - bleepingcomputer.com
Named Pipes Under Attack: Securing Windows Interprocess Communication - bleepingcomputer.com
Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight - securityweek.com
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit - thehackernews.com