New DOUBLECUP ClickFix service hides malware in browser cache images and content

A sophisticated Russian-originated loader-as-a-service, dubbed DOUBLECUP, has emerged, leveraging an advanced ClickFix attack methodology to embed malicious code within seemingly innocuous PNG images stored in victims’ browser caches, ultimately facilitating the delivery of the multi-platform CountLoader and a novel remote access trojan, DeviceManager, to compromised systems. This innovative approach to initial access and payload delivery signifies a concerning evolution in the cybercrime landscape, highlighting the increasing professionalization and technical prowess available to threat actors through illicit services.

The Rise of Loader-as-a-Service (LaaS) and DOUBLECUP’s Place

The proliferation of "as-a-service" models within the cyber underground has dramatically lowered the barrier to entry for aspiring and established threat actors alike. Loader-as-a-Service (LaaS) platforms represent a critical component of this ecosystem, providing the infrastructure, tools, and expertise necessary to establish initial footholds on target systems and deliver subsequent malicious payloads. DOUBLECUP, operational since at least early June 2026, exemplifies this trend, offering a comprehensive suite of capabilities to its clientele. This service handles much of the technical heavy lifting, including the secure hosting of steganographically enhanced images, managing critical session and signal endpoints, generating encryption keys, and automating the rebuilding of payloads to maintain evasiveness.

The strategic appeal of such a service lies in its ability to abstract away complex technical challenges from the end user. Customers of DOUBLECUP are provided with licenses and a bespoke Go-based Windows application, enabling them to configure intricate malicious campaigns and generate the necessary frontend code for integration into their chosen attack vectors. The selection of Go for the development of the client-side tool is notable; Go-compiled binaries are known for their cross-platform compatibility, self-contained nature, and relative difficulty in reverse engineering, offering an additional layer of resilience against analysis and detection. While DOUBLECUP manages the core infrastructure, customers retain responsibility for crafting and hosting the deceptive websites that display the ClickFix prompts, integrating the generated frontend code, and implementing any additional obfuscation or anti-analysis measures to enhance their campaigns’ stealth. This division of labor allows attackers to specialize, with the service provider focusing on robust infrastructure and evasion techniques, and the customer concentrating on effective social engineering and distribution.

Discovery and Operational Footprint

The existence and operational methodology of DOUBLECUP came to light during an investigation into an exposed directory residing at a specific IP address (213[.]139.77[.]109:9090). This directory contained various test files, inadvertently exposing elements of the service’s internal workings. Subsequent analysis identified the same IP address as hosting DOUBLECUP’s licensing panel, confirming its role as a central component of the service’s infrastructure. Such operational security oversights, while rare for sophisticated groups, occasionally provide invaluable insights into their activities, allowing security researchers to map out their tactics, techniques, and procedures (TTPs).

The ClickFix Attack Vector: Deception and Browser Cache Exploitation

At the heart of DOUBLECUP’s initial access strategy is the ClickFix attack, a social engineering technique designed to manipulate users into executing malicious commands. These campaigns frequently impersonate legitimate login pages for widely used business applications such as NetSuite, Odoo, HubSpot, and Salesforce. The malicious code is often injected via embedded iframes, a common technique for integrating third-party content, which in this context, is weaponized.

When a victim navigates to one of these compromised or crafted ClickFix sites, DOUBLECUP’s integrated code performs several critical actions. It first registers the user’s session and ascertains their public IP address. Crucially, it then forces the victim’s browser to download and cache a specially crafted PNG image containing the hidden malicious payload. Following this, the page presents a deceptive CAPTCHA-style prompt, instructing the user to paste and execute a command that has been silently copied to their clipboard by the malicious script. The psychological efficacy of this approach stems from users’ familiarity with CAPTCHA challenges and their conditioned response to follow on-screen instructions, especially within contexts that appear legitimate, like enterprise login portals.

The choice to hide the payload within a browser-cached image is particularly insidious. Browser caches are designed for performance optimization, storing frequently accessed web resources locally. This mechanism is rarely scrutinized by traditional security solutions in the same way as file downloads or executable attachments. By embedding the malicious code using steganography – the art of concealing data within other data – DOUBLECUP effectively bypasses many perimeter defenses that might otherwise flag suspicious file types or content. The steganographic image, appearing as a normal PNG, is downloaded and stored without raising immediate alarms. The malicious command copied to the clipboard, when executed by the victim, then programmatically searches the browser cache for this specific PNG, often identified by its precise file size, before using native system utilities like findstr or certutil to extract and execute the hidden first-stage payload. The reliance on "living off the land" binaries like findstr and certutil, which are legitimate Windows tools, further aids in evading detection, as their execution might not inherently trigger alerts in less sophisticated endpoint security systems.

Multi-Stage Payload Delivery and Execution

The execution sequence orchestrated by DOUBLECUP is a sophisticated multi-stage process designed for stealth and persistence. Once the victim executes the command from their clipboard, the initial payload, recovered from the cached PNG, is launched. This first payload is engineered to be lightweight and focused on evasion, primarily serving to initiate a fileless second-stage dropper. This dropper operates entirely in memory, further complicating its detection by disk-based scanning tools.

The second-stage dropper retrieves the victim’s public IPv4 address, which is then dynamically used to generate a unique decryption key for the final, encrypted payload. This dynamic key generation adds a layer of anti-analysis, making it harder for researchers to decrypt payloads without the specific context of an infected machine’s public IP. Before execution, the decrypted final payload is verified against a hardcoded SHA-256 hash, ensuring its integrity and preventing tampering. If the hash matches, the dropper proceeds to execute the final payload in memory, a technique that minimizes forensic artifacts and enhances stealth. The final payloads identified in DOUBLECUP campaigns are primarily an updated version of CountLoader and the newly observed DeviceManager RAT.

Analysis of Final Payloads: CountLoader and DeviceManager RAT

CountLoader:
CountLoader, delivered by DOUBLECUP, represents an updated iteration of a known information stealer and loader, now exhibiting cross-platform capabilities targeting both Windows and macOS environments. On Windows systems, CountLoader is designed to harvest extensive system information, scrutinize for the presence of cryptocurrency wallet applications and browser extensions, and detect whether Signal Desktop, a popular encrypted messaging application, is installed. This targeted data collection suggests an interest in financial exploitation and potential surveillance of secure communications. For persistence, CountLoader typically establishes scheduled tasks, a common and effective method to ensure re-execution across system reboots. Furthermore, CountLoader possesses the ability to download and execute arbitrary files, including MSI packages, PowerShell modules, and dynamic-link libraries (DLLs), granting attackers significant flexibility in subsequent malicious activities.

The macOS variant of CountLoader underscores the expanding ambition of threat actors to target Apple’s ecosystem. This version is compiled to support both Intel and Apple Silicon architectures, demonstrating a commitment to broad compatibility. It achieves persistence by installing a LaunchAgent, a standard macOS mechanism for automatically launching applications or scripts. To communicate with attacker-controlled servers, the macOS version leverages built-in utilities such as curl, sw_vers (system version), system_profiler (system hardware and software details), and ioreg (I/O Registry), again employing "living off the land" tactics to blend with legitimate system activity and avoid detection.

DeviceManager RAT:
DeviceManager is a recently identified, modular Remote Access Trojan (RAT) that primarily targets Windows systems. Its Python-based architecture offers inherent flexibility and ease of development, allowing for rapid feature integration and adaptation. A particularly innovative aspect of DeviceManager is its command-and-control (C2) communication mechanism, which employs blockchain smart contracts to determine the current C2 server’s IP address. This technique, known as EtherHiding, involves embedding C2 information within transactions or state variables of an Ethereum or Polygon smart contract. This method dramatically enhances the RAT’s resilience to disruption attempts, as traditional C2 takedown operations, which rely on domain or IP address blacklisting, are rendered ineffective against the decentralized and immutable nature of blockchain.

DeviceManager is configured to collect a comprehensive array of system information, including the machine GUID, disk identifier, user SID, hostname, username, operating system version, architecture, installed antivirus software, and domain information. Notably, this data collection is specifically observed in countries outside the Commonwealth of Independent States (CIS), a common geopolitical self-imposed restriction among Russian-linked cybercriminal groups to avoid targeting domestic victims. For actual data exfiltration and command retrieval, the RAT utilizes DNS A and TXT records, a stealthy method that often goes unnoticed by basic network monitoring, as DNS traffic is fundamental to almost all internet activity.

Broader Implications and Defensive Strategies

The emergence of DOUBLECUP and its sophisticated attack chain signifies a worrying trend in the cyber threat landscape. The LaaS model democratizes access to advanced attack capabilities, allowing less skilled or resourced actors to execute complex campaigns. The combination of ClickFix social engineering, browser cache steganography, multi-stage fileless execution, and resilient blockchain-based C2 represents a formidable challenge for conventional security measures.

Organizations must adopt a multi-layered, adaptive defense strategy to counter such threats:

1. Enhanced User Awareness and Training: Given the social engineering component of ClickFix attacks, continuous and targeted user education is paramount. Employees must be trained to recognize deceptive prompts, verify the legitimacy of URLs, and exercise extreme caution before pasting and executing commands from unknown sources, even if they appear to be CAPTCHA challenges.
2. Advanced Endpoint Detection and Response (EDR): EDR solutions are crucial for detecting post-exploitation activities, including fileless malware execution, the use of living-off-the-land binaries (findstr, certutil, curl), and anomalous process behavior. EDR can monitor memory, process trees, and command-line arguments for suspicious patterns that indicate an attack in progress.
3. Network Traffic Analysis: Deep packet inspection and network behavioral analytics are necessary to identify unusual DNS queries (potentially related to DeviceManager’s C2), communication with known malicious IPs, or unexpected connections to blockchain nodes that could indicate EtherHiding.
4. Proactive Threat Intelligence: Staying informed about emerging LaaS platforms, their TTPs, and the specific malware payloads they deliver (like CountLoader and DeviceManager) is vital for proactive defense and threat hunting.
5. Browser Security Hardening: Implementing strict content security policies (CSPs), regularly clearing browser caches, and utilizing browser extensions that enhance security can mitigate some aspects of the ClickFix vector.
6. Application Whitelisting and Control: Restricting the execution of unauthorized applications and scripts can prevent the final payloads from running, even if the initial stages of the attack are successful.
7. Robust Security Baselines: Enforcing strong security configurations, including robust password policies, principle of least privilege, and regular patching, reduces the overall attack surface.
8. Automated Threat Hunting: Proactively searching for indicators of compromise (IoCs) related to DOUBLECUP, such as specific file sizes of cached PNGs, unusual command-line executions, or known C2 patterns, is essential.

Future Outlook

The trajectory of cybercrime suggests that services like DOUBLECUP will continue to evolve, offering even more sophisticated evasion techniques and broader payload delivery options. We can anticipate further innovation in steganography, potentially utilizing other file types or more complex embedding methods, and an increased adoption of decentralized C2 mechanisms, leveraging not only blockchain but potentially other distributed ledger technologies. The ongoing arms race between cybercriminals and security professionals demands continuous adaptation, investment in advanced security technologies, and a collaborative approach to threat intelligence sharing. The DOUBLECUP ClickFix service is a stark reminder that attackers are constantly innovating, requiring defenders to remain vigilant and agile in their response.