[toxicpanda]

August 24, 2026

• ToxicPanda now abuses Android VPN permissions to cut victims off from Google Play, blocking Play Protect updates while it operates (BleepingComputer) (earlier coverage). Separately, Indian government blocking notices show Android malware impersonating ICICI, SBI and Axis banking apps using Firebase infrastructure (Ministry of Cyber Affairs). · Threat Activity & Cybercrime

in Four Days Dark: Iran-Linked Intrusion Knocked a UK Power Plant Offline

August 23, 2026

• Grandoreiro has resurfaced post-takedown with a Mexico-focused campaign and new anti-analysis and anti-detection features, part of a broader banking-trojan uptick alongside Manic and ToxicPanda 2.0 (Dark Reading, SecurityWeek). · Threat Activity

in A Good Day for Offensive Tooling: FortiOS Unpacking, GodPotato in Crystal, and an NTFS3 SUID Trick

August 22, 2026

• ToxicPanda 2.0 adds 167 remote commands and a PIN-harvesting workflow against 140+ banking and crypto apps, expanding globally alongside GoldDigger's on-device fraud capabilities (The Hacker News). · Threat Activity

in A CVSS 10.0 Lands in Entra ID — and Microsoft Can't Keep Its Exploitation Story Straight