DeviceManager GUID-suffixed GoogleUpdateService/MSEdgeUpdateService task with anomalous payload

Duo Tech@duotech

•updated Aug 6, 2026•3•0•1

Detects scheduled task creation or execution masquerading as GoogleUpdateService or MSEdgeUpdateService with a GUID suffix, combined with anomalous payload indicators such as csvchost.exe, psvchost.exe, App.py, python-3.13.13-embed-amd64.zip, or WakeToRun=$true, associated with the DOUBLECUP loader delivering the DeviceManager RAT.