================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, August 23, 2026 - 7:36 PM EDT ================================================================ Mobile threats dominate the day as ToxicPanda widens to 349 apps, Android car head units join proxy botnets, and Medusa ransomware crosses 500 victims. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Android malware is proliferating, from the ToxicPanda and Grandoreiro banking trojans hijacking VPN permissions across 349 apps to a car head-unit botnet running ad fraud. see: ToxicPanda and Grandoreiro Banking Trojans Expand; Android Car Head Unit Proxy Botnet * [TREND] Attackers scale up as Medusa ransomware claims more than 500 organizations and Apple pushes an unprecedented wave of spyware threat notifications to at-risk users worldwide. see: Medusa Ransomware Hits More Than 500 Organizations; Apple Spyware Warnings Surge * [UPDATE (updated)] Tariff fallout dominates, with the U.S.-Canada trade war escalating into fresh post-Labor-Day levies while economist Morici warns the turbulence imperils the GOP Senate majority. see: U.S.-Canada Trade War Escalates; Morici Warns Economy Imperils GOP Senate * [UPDATE (new)] Back-to-school stories converge as Homewood's Give Back hands out haircuts and supplies while Lewis faults Pennsylvania's adequacy formula for underfunding special-education students. see: Homewood Event Sends Kids Back to School; Lewis Faults Special-Education Funding * [UPDATE (new)] Steelers coverage rolls on with preseason grades after the Jets game, a new Not Just Football camp episode, and Pepi and Dest scoring for PSV. see: Steelers Weigh Winners and Losers After Jets; Not Just Football Continues Camp Series; Pepi and Dest Score for PSV * [TREND] In Reading, Apple accepts lower App Store fees in E.U. settlements, Zitron games out an OpenAI collapse, and Newport weighs AI coding's real value. see: Apple Settles With E.U., U.S. App Store Fees, ATT Rules in Germany; What Happens If OpenAI Dies?; On AI Coding and Its Discontents SECURITY ---------------------------------------------------------------- 1. TOXICPANDA AND GRANDOREIRO BANKING TROJANS EXPAND Ransomware and Cybercrime · [android, malware, banking] Latest developments: ToxicPanda now abuses Android VPN permissions to choke Google Play updates, widens its targeting to 349 applications, and carries 167 remote commands, as SecurityWeek spotlights a persistent Grandoreiro campaign sweeping Latin America and Europe. ToxicPanda is Android banking malware that steals credentials and drains banking and cryptocurrency accounts, and Grandoreiro is a long-running trojan hitting banks across Latin America and Europe. Users should install apps only from trusted stores and scrutinize every permission request. - BleepingComputer: https://www.bleepingcomputer.com/news/security/toxicpanda-android-malware-uses-vpn-permissions-to-block-google-play/ - SecurityWeek: https://www.securityweek.com/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotlight/ 2. MEDUSA RANSOMWARE HITS MORE THAN 500 ORGANIZATIONS Ransomware and Cybercrime · [ransomware, extortion] Latest developments: Medusa ransomware has struck more than 500 organizations, a sharp jump in the operation's victim tally. Medusa runs as ransomware-as-a-service, encrypting files and extorting victims across sectors worldwide. Organizations should patch internet-facing systems, enforce multifactor authentication, and keep offline backups. - Help Net Security: https://www.helpnetsecurity.com/2026/08/23/week-in-review-records-allegedly-stolen-from-azure-tenants-medusa-ransomware-hits-500-orgs/ 3. ANDROID CAR HEAD UNIT PROXY BOTNET Ransomware and Cybercrime · [android, supply-chain, botnet] Latest developments: New reporting shows the head-unit supply-chain malware enlists compromised units in a proxy botnet and commits ad fraud, riding a legitimate device-update app to spread across DoFun-built firmware. A supply-chain attack seeds malware in Android car head units through the built-in update app, then routes traffic through the victim devices or runs ad fraud. Buyers and integrators should verify firmware sources and watch head-unit network traffic. - BleepingComputer: https://www.bleepingcomputer.com/news/security/hackers-infect-android-car-head-units-with-proxy-botnet-malware/ 4. APPLE SPYWARE WARNINGS SURGE Nation-State Activity · [spyware, mobile] Latest developments: Apple sent an unprecedented number of threat notifications, warning users that mercenary spyware targets their devices. Apple's threat notifications alert individuals that state-grade mercenary spyware aims at their iPhones and other devices. Recipients should update immediately and turn on Lockdown Mode. - Wired Security: https://www.wired.com/story/security-news-this-week-your-expired-visa-card-could-be-zombiefied-to-make-contactless-payments/ BUSINESS AND POLITICS ---------------------------------------------------------------- * U.S.-Canada Trade War Escalates Latest developments: Canada answered the new U.S. levies with fresh post-Labor-Day tariffs of its own on August 23, and Ottawa and Washington traded blame for the collapse of talks a day after 50% U.S. tariffs took effect. President Trump's 50% tariffs on roughly $20 billion of Canadian goods and Prime Minister Mark Carney's retaliatory levies now threaten to push American prices higher months before the midterm elections, and Carney told Canadians that Trump 'miscalculated' by escalating. - WSJ World News: https://www.wsj.com/economy/trade/canada-announces-new-post-labor-day-tariffs-ef1de8e1?mod=rss_worldnews - FT World: https://www.ft.com/content/e3b5c236-bd5f-45c2-8ddf-5279a7375d3f?syn-25a6b1a6=1 - FT World: https://www.ft.com/content/39baf33e-3238-4923-9fe9-f1db48bb54e4?syn-25a6b1a6=1 PITTSBURGH ---------------------------------------------------------------- Weather: Tonight: Chance Rain Showers then Slight Chance Showers And Thunderstorms, low 56F. Monday: Mostly Sunny, high 73F. Monday Night: Partly Cloudy, low 57F. Business: * Morici Warns Economy Imperils GOP Senate Latest developments: Economist Peter Morici argued in TribLive on August 23 that President Trump's tariffs and economic turbulence now put Republican control of the U.S. Senate at risk in November. Peter Morici, a University of Maryland economist writing for TribLive, contends that Trump's remaking of the economy and America's global standing could cost Republicans their Senate majority in the midterm elections. - TribLive: https://triblive.com/opinion/peter-morici-troubled-trump-economy-puts-gop-control-of-senate-at-risk/ * Jeannette Contractor Charged With Fraud Latest developments: Police charged a Jeannette man with home improvement fraud, WPXI reported August 23, after they said he took payment for a painting job and never did the work. A Jeannette man faces multiple charges in Westmoreland County after police said he accepted money for contracting work and never performed it, a caution for homeowners hiring tradespeople. - WPXI: https://www.wpxi.com/news/local/contractor-facing-home-improvement-fraud-charge-after-failing-paint-westmoreland-county-home/WFHMYVMKQZETFKPX5GJ4BLE5RE/ Around town: * Wilkins Township Road Closes for Repairs Latest developments: A road in Wilkins Township will close Monday, August 24, for emergency repairs, WTAE reported August 23, as crews clear storm debris that backed up against a bridge deck. Crews in Wilkins Township, Allegheny County, will temporarily shut a road starting Monday to remove storm debris jammed against a bridge deck and to handle other maintenance. - WTAE: https://www.wtae.com/article/wilkins-township-road-temporary-closure-emergency-repairs-monday/73505304 * Lewis Faults Special-Education Funding Latest developments: In a TribLive op-ed August 23, Andrew Lewis argued that Pennsylvania's adequacy-funding formula leaves several Western Pennsylvania school districts ill-equipped to serve a rising number of special-education students. Andrew Lewis contends that Western Pennsylvania districts absorbing large influxes of special-education students remain underfunded, a gap he says the state's adequacy formula fails to close even as overall aid rises. - TribLive: https://triblive.com/opinion/andrew-lewis-pa-public-education-is-anything-but-adequate/ * Homewood Event Sends Kids Back to School Latest developments: A community event called The Give Back in Pittsburgh's Homewood neighborhood offered children free haircuts and school supplies on August 23, days before classes resume. Organizers of The Give Back styled local children's hair and handed out school supplies in Homewood, timing the effort to the start of the new school year. - WPXI: https://www.wpxi.com/news/local/give-back-kids-get-free-haircuts-school-supplies-during-community-event-homewood/FZAPC6S6QFGYHGNW5GHYAFALQM/ SPORTS ---------------------------------------------------------------- Around the Teams: * Steelers Weigh Winners and Losers After Jets Latest developments: The Post-Gazette graded which Steelers helped or hurt their roster case after the second preseason game against the New York Jets, spotlighting the quarterback picture around Will Howard and Drew Allar. The Post-Gazette's rising-and-falling review of the Steelers' preseason loss to the Jets weighed the young quarterbacks' standing under head coach Mike McCarthy as roster decisions near. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/08/21/nfl-steelers-jets-preseason-will-howard-quarterback/stories/202608210033 * Not Just Football Continues Camp Series Latest developments: Cam Heyward's 'Not Just Football' podcast released the second episode of its training-camp series on August 21, featuring defensive linemen Keeanu Benton and Sebastian Joseph-Day. Cam Heyward and Hayden Walsh hosted Steelers defensive linemen Keeanu Benton and Sebastian Joseph-Day on 'Not Just Football,' talking through the coming season on the show's Monday-Wednesday-Friday camp run. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=3OTIxTpCMCU Team USA: * Pepi and Dest Score for PSV Latest developments: United States forward Ricardo Pepi and defender Sergiño Dest both scored on August 23 as PSV Eindhoven routed Groningen 5-1 in the Eredivisie. Ricardo Pepi and Sergiño Dest, both regulars for the U.S. men's national team, found the net in PSV Eindhoven's 5-1 win over Groningen, a lift for two Americans ahead of the 2026 World Cup the United States co-hosts. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49701689/usmnt-ricardo-pepi-sergino-dest-score-psv-51-rout READING ---------------------------------------------------------------- * Stratechery -- Apple Settles With E.U., U.S. App Store Fees, ATT Rules in Germany Ben Thompson argues Apple's App Store is finally accepting the reality of lower fees in settlements with the E.U. and U.S., and that the E.U. should count the outcome a win even though the change arrived late. https://stratechery.com/2026/apple-settles-with-e-u-u-s-app-store-fees-att-rules-in-germany/ * Ed Zitron -- What Happens If OpenAI Dies? Ed Zitron games out the consequences of an OpenAI collapse, arguing that the company's failure would ripple through the AI infrastructure, deals, and expectations built on top of it. https://www.wheresyoured.at/what-happens-if-openai-dies/ * Cal Newport -- On AI Coding and Its Discontents Cal Newport examines AI-assisted programming through the account of a Silicon Valley engineer who turned from skeptic to convert, weighing how much the tools actually change the work of building software. https://calnewport.com/on-ai-coding-and-its-discontents/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,692.07 ▼ -0.9% Dow 53,260.49 ▼ -1.0% Nasdaq 26,302.67 ▼ -1.2% WTI crude 86.03 ▲ +4.3% EUR/USD 1.1620 ▲ +0.7% GBP/USD 1.3575 ▲ +0.6% USD/JPY 159.05 = +0.0% ================================================================ Generated 2026-08-23 19:36 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================