DOUBLECUP has operated since early June 2026 as a Russian “loader-as-a-service” that builds ClickFix campaigns which hide malicious code inside PNG images cached by victims’ browsers, ultimately delivering CountLoader to Windows and macOS devices and a new DeviceManager RAT to Windows systems, SOCRadar’s Threat Research Unit says.
How the DOUBLECUP ClickFix chain operates
DOUBLECUP provides a workflow that chains web-based social engineering to steganography and in-memory execution. A customer uses a Go-based Windows application to configure a campaign’s domain, URL path, steganography method, embed type, execution action and payload locations. That tool generates an API configuration endpoint which returns a steganographic image URL and file size, a session endpoint, and browser-specific commands for Chrome, Edge, Firefox, Brave and Opera.
Operators add DOUBLECUP’s generated code to ClickFix-style sites. When a victim opens such a page—SOCRadar observed fake CAPTCHA prompts impersonating NetSuite, Odoo, HubSpot and Salesforce served via embedded iframes—the site retrieves the configuration, forces the browser to download and cache a malicious PNG, registers the session and copies a command matched to the visitor’s browser into the clipboard. The page then displays instructions attempting to convince the user to paste and run that clipboard command.
Steganography in browser cache PNGs and the execution chain
The clipboard-entered command searches the browser cache for the PNG by its exact file size and uses Windows utilities such as findstr or certutil to extract the hidden first-stage payload from the image. That first-stage payload launches a fileless second-stage dropper which retrieves the victim’s public IPv4 address and uses it to create a decryption key for the final, encrypted payload. The dropper verifies the decrypted payload against a hardcoded SHA-256 hash and then executes it in memory.
DOUBLECUP automates hosting of the steganographic PNGs, manages session and signal endpoints, provides encryption keys and can automatically rebuild payloads; customers remain responsible for creating and hosting the ClickFix pages and adding any extra obfuscation or anti-analysis measures.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →CountLoader and DeviceManager: the delivered payloads
SOCRadar recovered two distinct final payload families delivered through DOUBLECUP. An updated CountLoader targets Windows and macOS and focuses on information collection and persistence. On Windows it harvests system information, checks for cryptocurrency wallet applications and browser extensions, determines whether Signal Desktop is installed, and establishes persistence via scheduled tasks. CountLoader can also download and execute additional files including MSI packages, PowerShell modules and DLLs.
SOCRadar also recovered a macOS build of CountLoader compiled for both Intel and Apple Silicon; that variant installs a LaunchAgent for persistence and leverages built-in utilities such as curl, sw_vers, system_profiler and ioreg to communicate with attacker-controlled servers.
The second payload family appears to be a previously undocumented DeviceManager RAT: a modular, Python-based Windows remote access trojan that uses blockchain smart contracts to determine the IP address of its command-and-control server. DeviceManager uses a technique SOCRadar calls EtherHiding to read a current C2 address from an Ethereum or Polygon smart contract and employs DNS A and TXT records to steal system information, retrieve commands, download payloads and return command output. In countries not part of the Commonwealth of Independent States (CIS), DeviceManager collects fields including the machine GUID, disk identifier, user SID, hostname, username, OS version, architecture, installed antivirus software and domain information.
DOUBLECUP as a service and the discovery
SOCRadar discovered DOUBLECUP while investigating an open directory at 213[.]139.77[.]109:9090 that contained test files; the same IP later appeared to host the service’s licensing panel. The service’s model is turnkey: it supplies the steganographic hosting, session and encryption infrastructure and a campaign builder, while customers supply the web pages used for the ClickFix prompts and any additional operator-side measures.
What this means for security teams, enterprises using NetSuite/Odoo/HubSpot/Salesforce, and incident responders
- Security teams and technologists: watch for unusual PNG downloads and browser cache files whose file sizes match unexpected artifacts; monitor for clipboard execution patterns and use of findstr or certutil to read binary data from images. The chain’s fileless second-stage dropper and in-memory execution reduce disk artifacts and complicate detection.
- Enterprises using NetSuite, Odoo, HubSpot and Salesforce: be alert for fake CAPTCHA prompts delivered on login pages or embedded iframes that request pasting and executing clipboard content; these brands were impersonated in SOCRadar’s observations.
- Incident responders and threat hunters: look for persistence indicators reported here—scheduled tasks on Windows, LaunchAgent entries on macOS—and for unusual DNS A/TXT queries or blockchain interactions that could indicate DeviceManager’s EtherHiding technique.
DOUBLECUP’s combination of turnkey infrastructure, browser-cache steganography and blockchain-based C2 resolution raises the bar for both detection and takedown: SOCRadar’s findings show an attacker-friendly service that splits technical complexity between a centralized backend and operator-controlled web pages. How defenders adapt logging and detection to expose malicious cached images, clipboard abuse and EtherHiding-driven C2 lookups will shape whether campaigns like these remain noisy testbeds or become a persistent distribution vector.
Source: BleepingComputer — New DOUBLECUP ClickFix service hides malware in browser cache images
