What you can upload to Mythos

Doctored photos, fake brands, visual deepfakes.

• Deep EXIF, IPTC, XMP metadata (camera + editor + GPS leak)
• Brand recognition: Poste, Intesa, INPS, Carabinieri + 50 other brands
• Error Level Analysis and copy-move/splice detection
• OCR + extraction of IBANs, phone numbers, URLs, amounts, urgency words
• JPEG quantization: native camera vs editor vs WhatsApp recompressed
• Steganography (binwalk) and C2PA Content Credentials
• Reverse image search on Google Lens
• Hash reputation on VirusTotal (2500 queries/day pool)

Embedded JavaScript, forged signatures, hidden attachments.

• Embedded JavaScript extraction and OpenAction/Launch detection
• Embedded files inventory
• Digital signature validation (PAdES/CAdES)
• Brand impersonation against 50+ known logos
• Hash reputation on VirusTotal

VBA macros, DDE injection, disguised polyglots.

• VBA macro decompilation with olevba
• DDE injection detection
• Hidden sheets and external template-injection links
• Embedded OLE objects and hidden text
• Polyglot detection (JAR/APK disguised as Office)

Forged headers, brand impersonation, unauthenticated sender.

• SPF, DKIM, DMARC verdicts
• ARC seal validation and BIMI verification
• DKIM key tenure (anti-rotation abuse)
• Received-chain anomalies (backwards timestamps = forged headers)
• Header order analysis (fake MUA fingerprints)

Phishing, malware drop, crypto drainers.

• DNS posture and TLS posture
• Multi-source reputation: urlscan.io + VirusTotal
• Threat-intel aggregate score
• Chainabuse for crypto-adjacent URLs (rug-pull, drainer)

Cloned voices, synthetic audio, vishing scams.

• Full ffprobe metadata
• Full transcription with Mythos audio engine
• Voice-clone detection: mean volume, spectral flatness, ElevenLabs/PlayHT/Coqui tag scan
• IBAN, phone, URL, urgency extraction from transcript

Deepfake video, fake CEOs, AI-generated blackmail.

• ffprobe metadata and per-second frame sampling
• Per-frame brand recognition
• Audio-track transcription with Mythos audio engine
• Deepfake heuristics: blink-rate proxy, frame-rate uniformity, A/V sync drift
• Encoder-tag scan for Sora, Runway, Pika, HeyGen, DeepFaceLab

Pig-butchering, money mule, 'Hi mum', grooming.

• Participants, timeline, per-participant message counts
• IBAN, phone, URL, amount, urgency extraction
• Scam composite: pig-butchering, money-mule pressure
• Family impersonation 'Hi mum' and asymmetric grooming ≥70%
• Telegram VIP/trading channel detection

Banking trojans, rogue MDM, malicious root CAs.

• APK static: binary AndroidManifest, signing cert, dangerous-permission scan (banking trojan)
• IPA static: Info.plist + provisioning entitlements
• .mobileconfig: root CA install, MDM enrolment, forced VPN detection
• RAR/7Z/ISO/CAB archives with polyglot detection