Notable Threat Actor Activity

  • The ToxicPanda Android malware has expanded its capabilities, now targeting 349 applications and supporting 167 remote commands. It abuses VPN permissions to block access to Google Play, hindering users from downloading security updates or alternative apps [1].

Trends, Tools, or Tactics of Interest

  • DOUBLECUP malware has been observed using PNG payloads. Despite initial claims, it does not employ genuine steganography techniques but rather hides malicious code in plain data within PNG files [2].
  • Anthropic has expanded access to its Mythos 5 security platform, which now includes codebase scanning for Claude Enterprise customers. The company also announced a 35 million USD open source fund aimed at supporting security initiatives [4].

Sources#

  1. ToxicPanda Android malware uses VPN permissions to block Google Play - bleepingcomputer.com
  2. DOUBLECUP's PNG Payload, (Mon, Aug 24th) - isc.sans.edu
  3. Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund - securityweek.com