DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
SOCRadar details DOUBLECUP, a Russian loader-as-a-service active since June 2026 that uses ClickFix lures to stage steganographic PNG images in browser caches, delivering CountLoader and a previously undocumented DeviceManager RAT.
Intelligence analysis by Llama
Threat researchers at SOCRadar have exposed DOUBLECUP, a Russian loader-as-a-service that abuses ClickFix social engineering and hidden PNG payloads cached in victims' browsers. The operation drops CountLoader and a new DeviceManager RAT, with operators managing campaigns through a Go-based client, Telegram bot, and fake CRM impersonation pages.
Hackers built a subscription service called DOUBLECUP that tricks people into copying and pasting a bad command on fake login pages. It hides nasty code inside normal-looking picture files that the browser quietly saved, then uses the visitor's own internet address to unlock the hidden program on their computer.
Analysis
A Loader-as-a-Service with Retail-Grade Operator UX
DOUBLECUP, tracked by SOCRadar since early June 2026, is described as a Russian loader-as-a-service built around the ClickFix social engineering pattern. According to the report, the service offers license-based access with unique keys tied to client IP addresses, active days, labels, and versions, with multiple campaigns allowed per license. The operational toolkit includes a Go-based Windows GUI client, a Payload Builder Pane for configuring ClickFix decoys, and a Broadcast Pane for issuing live operator commands. This level of polish indicates the operators are treating malware delivery less like a bespoke intrusion and more like a subscription product line.
Steganography Meets Environmental Keying
The technical core of DOUBLECUP avoids traditional dropper indicators. The first stage pushes a steganographic PNG into the victim's browser cache, then retrieves and executes hidden content. The second stage decrypts a final payload in memory using a custom SHA-256 CTR stream cipher combined with bitwise XOR, where the cryptographic seed is the victim's public IPv4 address. SOCRadar notes that this environmental keying causes decryption to fail on any analyst machine, raising the cost of static and dynamic analysis. DeviceManager, the previously undocumented RAT, adds another evasion layer by using EtherHiding to resolve its command-and-control infrastructure over HTTP or DNS tunneling, blending victim traffic with legitimate blockchain-related lookups.
ClickFix Funnels, Fake CRMs, and a Multi-Platform Reach
SOCRadar tied DOUBLECUP campaigns to a cluster of bogus sites impersonating NetSuite, Odoo, HubSpot, and Salesforce login pages, which serve ClickFix instructions through embedded iframes. Once executed, the clipboard is populated with browser-matched PowerShell, VBScript, or JavaScript commands tailored to Chrome, Edge, Firefox, Brave, and Opera. The delivered CountLoader is noteworthy for its cross-platform ambition: updated Windows and macOS variants establish persistence via scheduled tasks, audit installed browser extensions for cryptocurrency wallets, scan the host for Signal's desktop app, and inspect desktop shortcuts for popular browsers — though the shortcut-rewrite feature appears to be incomplete or dormant code. A separate Telegram bot (@harrypoterlohBOT), managed by a threat actor known as "johnnysilverhe" who also published a suspicious VS Code extension called Agent IDE, ties the operation together by tracking client visits, delivering keys, and receiving payload callbacks. The convergence of a managed LaaS front end, environmental keying, and EtherHiding C2 suggests defenders should expect DOUBLECUP-style offerings to become templates rather than one-offs.
Key points
- SOCRadar documents DOUBLECUP, an active Russian loader-as-a-service since June 2026, operated via a Go-based GUI client and a Telegram bot under the handle "johnnysilverhe".
- The loader stages steganographic PNG images in browser caches and decrypts subsequent payloads with a SHA-256 CTR cipher keyed to the victim's public IPv4 address.
- Delivered payloads include updated Windows and macOS CountLoader variants and a previously undocumented DeviceManager RAT that uses EtherHiding for HTTP and DNS tunneling C2.
- Campaigns impersonate CRM login pages including NetSuite, Odoo, HubSpot, and Salesforce to deliver ClickFix clipboard commands tailored per browser.
- CountLoader now audits browser extensions for crypto wallets, profiles for Signal desktop installs, and contains an unfinished browser shortcut-rewrite routine.
SOCRadar's exposure of the open license panel at "213.139.77[.]109:9090" and the configuration endpoint pattern at /api/config gives defenders and hosting providers concrete artefacts to detect, sinkhole, and monitor for DOUBLECUP infrastructure. Public identification of the @harrypoterlohBOT operator and the suspect "Agent IDE" VS Code extension adds opportunities for marketplace takedowns and brand-protection actions.
The environmental keying tied to victim IPs, EtherHiding-based C2, and a Telegram-managed operations backend make sustained disruption difficult, and the licensing model lets any number of new affiliates spin up ClickFix campaigns with minimal effort. Persistent focus on crypto wallet browser extensions and credential harvesting through fake CRM portals points to continued financial theft and supply-chain phishing pressure on enterprise sales and finance teams.
