SOC Radar-style hype around “stealthy” malware often leads defenders to overfocus on the headline technique. In this case, the DOUBLECUP write-up suggests the PNG-themed delivery wasn’t actually true steganography—meaning defenders should look beyond the veneer and validate how the loader/payload chain really operates. The broader takeaway: attackers will increasingly package familiar tradecraft in new wrappers to evade intuition and screening heuristics.
Source: SANS ISC
CISA adds a maximum-severity Oracle HTTP Server / WebLogic flaw (CVE-2026-21962) to KEV
The U.S. CISA has added CVE-2026-21962 (CVSS 10.0) to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The flaw affects Oracle HTTP Server and Oracle WebLogic Server components exposed to network-based access, and it carries immediate remediation urgency for organizations running these platforms. Teams should prioritize patching (or mitigations) and validate exposure paths, not just internal service assumptions.
Source: SecurityAffairs
Malware campaigns expand: PavinLoader delivered via ClickFix and fake download traps
Researchers report PavinLoader being leveraged across multiple lures, including ClickFix-style experiences and fake software/download campaigns. The same ecosystem is associated with delivery of Amatera Stealer and other follow-on malware, underscoring how common “web deception” components are becoming multi-purpose distribution infrastructure. Defenders should harden web paths, improve detection for “fake security” or “fake captcha/verification” flows, and tighten allowlisting around risky redirects.
Source: Malwarebytes Blog
ToxicPanda 2.0: Android banking Trojan adds stronger takeover and play-store blocking
ToxicPanda 2.0 is described as an upgraded Android banking Trojan that can seize control of infected devices and block access to Google Play and Google Play Services. That combination is particularly dangerous: it not only enables fraud activity, but can also impede easy remediation steps like reinstalling or updating security apps. Mobile teams should treat banking Trojans as full-control threats and focus on rapid containment, user guidance, and detection of app-control behaviors.
Source: Malwarebytes Blog
Fake “security scans” target Windows users to push AV uninstall + refund scams
Threat actors are using fake Microsoft-branded scanners to “invent” security problems and persuade victims to uninstall antivirus software. After deprovisioning defenses, the flow pivots into refund scams—showing how social engineering and security disablement are being braided into single campaigns. Organizations should reinforce user/verifier training and strengthen technical controls that detect security product tampering and suspicious uninstall/reinstall patterns.
Source: Malwarebytes Blog
Android car head units hit via built-in updaters: proxy botnet malware risk
Kaspersky reports an Android malware infection chain affecting car head units through built-in software updaters, turning devices into ad-fraud tools and proxy botnet nodes. This highlights a high-impact expansion of IoT/vehicle-adjacent attack surfaces into “trusted update” pathways that users and fleets assume are safe. Fleet operators and OEM partners should review update integrity controls, monitor unusual outbound traffic, and verify that updater mechanisms are strongly authenticated and hardened.
Source: Help Net Security
You can’t ignore “silent audio” browser fingerprinting: AliExpress-linked technique resurfaces
AliExpress was reported using silent audio to fingerprint visitors’ browsers without relying on cookies—an approach that can bypass common consent- and cookie-based tracking assumptions. Audio-context fingerprinting also demonstrates how adversaries can repurpose media processing and edge behavior to generate stable device/browser signals. Privacy and security teams should consider this in threat modeling for tracking resistance and implement stronger browser-level protections where possible.
Source: Malwarebytes Blog
You May Also Be Interested In...
CISA warns of exploited Oracle WebLogic vulnerability
CISA’s logging guidance works beyond government
Bipartisan Senate bill aims to prepare energy sector for Q-Day