DOUBLECUP's PNG Payload, (Mon, Aug 24th)
2026-08-24T19:23:41Z•8b4e6319dbe5e35b9397b209564a098bf9a6934a42fef71b871224d6dcf83cd4
DOUBLECUPEntra IDIAM credentialsMFAMicrosoft 365Microsoft GraphPNG payloadPowerShellSANS ISCcloud metadata servicecloud securitymalwarepassword sprayingsteganographythreat detection
What happened
SANS Internet Storm Center RSS entries covering the DOUBLECUP PNG-based payload, MFA rollout gaps, Microsoft Graph and PowerShell use for Entra/M365 account and login analysis, password-spray detection, and cloud metadata service scanning. The material is defensive and threat-intelligence focused; no specific vulnerability identifiers are provided.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- 8b4e6319dbe5e35b9397b209564a098bf9a6934a42fef71b871224d6dcf83cd4
- Enrichment time
- 2026-08-24T19:23:41Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.