SANS Stormcast Tuesday, August 25th, 2026: DOUBLECUP PNG; WebAudio Fingerprinting; Expired Domains; Android; Car
Summary
This episode analyzes DoubleCup malware using PNG files to hide PowerShell scripts and AliExpress employing Web Audio API for browser fingerprinting. It highlights a DMARC reporting vulnerability where expired domains allowed attackers to intercept email security reports. Finally, it discusses Kaspersky’s discovery of Malabar malware installed on Android car head units via a compromised software update channel.
Topics discussed
Introduction and SANS ISC Stormcast welcome
DoubleCup malware abusing PNG files for PowerShell
AliExpress using Web Audio API for fingerprinting
DMARC reporting risks with expired domains
Malware found on Android car head units
Listen ad-free on Castria