"The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second stage," SOCRadar said.
How DOUBLECUP uses ClickFix, cached PNGs, and browser commands
DOUBLECUP is a loader-as-a-service that stages malware by embedding steganographic PNG images in victims' browser caches and triggering browser-specific commands delivered from malicious ClickFix landing pages. Operators create a campaign endpoint at https://{{domain}}/{{slug}}/api/config; a GET to that endpoint returns configuration data including the steganographic image URL, image size, a session endpoint, and browser-tailored commands for Chrome, Edge, Firefox, Brave, and Opera.
Operators inject frontend code into a ClickFix page that: fetches the /api/config endpoint, prefetches the steganographic image, registers a session, evaluates the User‑Agent to select the browser payload, displays ClickFix instructions, copies the browser-matched command to the victim's clipboard, and initiates polling to perform a final redirect. When executed, the commands search the browser cache for the PNG, extract hidden JavaScript, VBScript, or PowerShell from it, and launch the second-stage component.
Operator tooling, licensing panel, and Telegram coordination
SOCRadar traced DOUBLECUP activity to an open directory at 213.139.77[.]109:9090 that exposed testing files tied to a DOUBLECUP license panel. The service provides operators with licenses and a client agent. Each license contains a unique key and metadata such as the client's IP address, active days, label, and version; a single license can support multiple campaigns.
The Go-based Windows GUI client supplies operator conveniences: a Broadcast Pane to issue commands and a Payload Builder Pane to compose the ClickFix-triggered payload by specifying domain, slug, steganography method, embed type, archive format, action, and payload URLs. A Telegram bot, @harrypoterlohBOT, is used to track client visits, send commands, deliver keys, and receive payload callbacks via a designated DOUBLECUP URL; the bot is managed by an actor using the name "johnnysilverhe," who has also published an extension called Agent IDE in the Visual Studio Code marketplace.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →CountLoader: Windows and macOS variants, persistence features
DOUBLECUP parcels include updated Windows and macOS builds of CountLoader. The loader's stated objectives include connecting to a C2 server, gathering system metadata for exfiltration, and awaiting operator tasks. CountLoader can run secondary executables, DLLs, MSI files, or HTA files; download compressed archives; extract and execute the main binary inside; and remove persistence mechanisms that could leave forensic traces.
New capabilities in CountLoader include establishing persistence via scheduled tasks, auditing installed browser extensions for cryptocurrency wallets, and profiling the host to detect Signal's desktop app. The Windows build also contains a function that scans the desktop and Start Menu for browser shortcut (.LNK) files and rewrites their targets so double-clicking a browser shortcut launches the browser and the RAT in the background; SOCRadar noted that this function is never invoked, suggesting it may be incomplete or dead code. CountLoader evades process monitoring by copying and header-patching legitimate Windows binaries.
DeviceManager: EtherHiding, installer behavior, and anti-analysis
DeviceManager is a previously undocumented, modular Python-based RAT delivered via the DOUBLECUP pipeline. It uses EtherHiding: resolving active C2 nodes through Ethereum/Polygon smart contracts before establishing communications. The malware embeds an encrypted payload inside a Delphi-compiled Inno Setup installer; when launched, it extracts a full embedded Python environment and spawns the Python malware.
DeviceManager deliberately avoids execution on machines that resolve to Commonwealth of Independent States (CIS) language locales: if a CIS language is detected the trojan executes a self-deletion routine that removes its scheduled task, deletes its installation directory via cmd.exe, and terminates execution. In active infections DeviceManager collects extensive device information, uses blockchains to extract the C2 server ("91.92.240[.]100"), and communicates with that server over DNS or HTTP to exfiltrate data, poll for tasks, download payloads, run PowerShell and Python scripts, and pipe operator commands into cmd.exe.
What this means for security teams, enterprises, and end users
- Security teams: DOUBLECUP combines steganography, browser-targeted commands, and environmental keying that derives cryptographic keys from a victim's public IPv4 address; teams will be monitoring for anomalous GETs to /api/config endpoints, unexpected steganographic assets on corporate domains, and callbacks tied to the Telegram bot or the IPs highlighted by SOCRadar.
- Enterprises and procurement: campaigns have used bogus CRM login pages — including impersonations of NetSuite, Odoo, HubSpot, and Salesforce — with embedded iframe elements to deliver the loader; organizations that host customer-facing pages should be aware that such pages can be abused as staging grounds for steganographic images and ClickFix code.
- End users: the attack chain is triggered through ClickFix-style instructions copied to clipboards and executed in a browser context; the visible breadcrumb is a redirect or a ClickFix instruction flow that ultimately unearths a cached PNG containing hidden code.
SOCRadar assessed DOUBLECUP as active since early June 2026 and concluded that "DOUBLECUP highlights the expanding reach of ClickFix campaigns, providing threat actors with a low-friction, highly reliable payload delivery pipeline" built with evasion in mind through steganography and environmental keying. The novel pairing of browser-cache steganography, blockchain-based C2 resolution, and operator conveniences in a licensed panel presents a distinct delivery pattern defenders will need to recognize.
