2026-08-24
Population: stories first tracked on this archive day in America/New_York; publisher date is used only if first-tracked time is unavailable and remains on each item.
- threat intel
DOUBLECUP's PNG Payload
DOUBLECUP malware appends a PowerShell payload to PNG files, prefixed with carriage-return and newline characters that allow Windows FINDSTR to extract and execute it without custom tools. The technique relies on shell command parsing rather than true steganography or image metadata embedding.
Why it matters: Defenders and endpoint teams should monitor for suspicious PNG files piped to PowerShell and FINDSTR execution chains, as this low-detection-overhead delivery method may enable malware execution on systems with limited logging.
- industry
Anthropic Expands Mythos 5 Access to More Defenders, Unveils $35M Open Source Fund
Anthropic has expanded access to Claude Mythos 5 for more security defenders, with the model now capable of running codebase scans through Claude Security, which is in public beta for Claude Enterprise customers. The company also announced a $35 million open source fund.
Why it matters: Enterprise security teams using Claude can now leverage an advanced AI model for automated code scanning, and open source projects may gain funding support for security improvements.
- ai security
Product showcase: AI Paper Trail shows the privacy cost of talking to AI
Proton has released AI Paper Trail, a free tool that analyzes exported ChatGPT and Claude conversation histories to generate privacy reports showing what personal information can be inferred from those interactions. The tool uploads data temporarily for analysis and deletes it afterward, helping users understand the aggregate privacy implications of their AI conversations.
Why it matters: Security practitioners and privacy advocates should understand that aggregated AI conversations can expose sensitive personal details; this tool helps organizations and individuals audit their exposure before deploying or heavily using AI services.
- threat intel
Fake bank websites play dead to evade security scanners
Fortra Intelligence and Research Experts identified a phishing technique called Chameleon SEO Poisoning that uses search result manipulation and cloaked fake banking websites to harvest credentials while evading detection. The method ranks malicious pages for banking-related keywords and adapts content based on visitor type, making it invisible to security scanners. Cases increased 40% during the second quarter of 2026.
Why it matters: Banking customers and security teams need to understand this evasion technique targets high-intent search queries; practitioners should monitor for cloaking behavior and educate users on verifying URLs before entering credentials.
- vulnerabilities
Risky Bulletin: Expired cards can be used for new transactions
Academics at the University of Massachusetts Amherst disclosed an attack that exploits incomplete encryption in NFC contactless payment cards. The technique intercepts transaction data via man-in-the-middle tactics, modifies the expiration date without invalidating the card's signature, and relays the altered payment to a point-of-sale terminal to execute unauthorized transactions.
Why it matters: Merchants and payment processors should assess their NFC terminal validation logic, as this attack affects contactless card acceptance workflows and could enable fraud with expired cards in their payment infrastructure.
- ransomware
Ransomware attackers are zeroing in on mid-market companies
Mid-sized companies with annual revenue between $10 million and $1 billion accounted for 73% of publicly disclosed ransomware and data-extortion incidents in North America and Europe from January 2023 through June 2026, according to Black Kite research. This segment consistently represented 72% to 75% of incidents throughout the period, demonstrating sustained attacker focus on this market tier.
Why it matters: Mid-market companies face disproportionate ransomware risk and should prioritize incident response planning, backup strategies, and threat intelligence specific to attackers targeting their revenue class.
- cloud saas
AWS makes it easier to spot firewall rules that have gone quiet
AWS Network Firewall now offers a rule hit count capability that shows security teams which stateful firewall rules are actively matching traffic. The feature applies to both custom and managed rule groups, is enabled by default, and incurs no additional charges beyond standard Network Firewall costs.
Why it matters: AWS customers can use this visibility to identify and remove unused firewall rules, reducing configuration bloat and validating that security controls function as intended.