New DOUBLECUP ClickFix service hides malware in browser cache images
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.
Intelligence analysis by Llama
DOUBLECUP is a Russian loader-as-a-service that uses ClickFix attacks to hide malware in browser cache images. It delivers CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.
Imagine you visit a website that looks normal, but it secretly tries to trick you into running a command that installs malware on your computer. This is what DOUBLECUP does, but instead of running a command, it hides malware in a picture that your browser downloads and stores. When you visit the website, the malware is executed, and it can steal your information or take control of your computer.
Analysis
A New Threat Emerges
DOUBLECUP is a Russian loader-as-a-service that has been operating since early June 2026. It provides customers with licenses and a Go-based Windows tool for creating malicious campaigns and generating the code operators add to their websites. The service handles much of the infrastructure required to conduct the attacks, including hosting the steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads.
To launch an attack, a DOUBLECUP customer uses the Go-based Windows application to configure the campaign's domain, URL path, steganography method, embed type, execution action, and payload locations. This generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera. Operators then add DOUBLECUP's code to their ClickFix sites, which retrieves the configuration, preloads the steganographic image into the victim's browser cache, registers the session, selects the command matching the victim's browser, and copies it to the clipboard when the page is opened.
Malware Hidden in the Browser Cache
In a new report, SOCRadar says it observed DOUBLECUP ClickFix campaigns using fake CAPTCHA prompts on login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce, with the malicious code loaded through embedded iframes. When a victim visits one of these sites, DOUBLECUP registers the session, determines the victim's public IP address, and forces the browser to download and cache a malicious PNG image. The page then displays fake CAPTCHA-style instructions that attempt to convince visitors to paste and run a command automatically copied to their clipboard.
The Attack Flow
Once executed, the command searches the browser cache for the PNG based on its exact file size and uses the findstr or certutil commands to recover and execute the hidden first-stage payload inside the image. The first payload launches a fileless second-stage dropper, which retrieves the victim's public IPv4 address and uses it to create a decryption key for the final encrypted payload. After verifying the decrypted payload against a hardcoded SHA-256 hash, the dropper executes it in memory.
SOCRadar says the final payloads are CountLoader and a new DeviceManager RAT.
Key points
- DOUBLECUP is a Russian loader-as-a-service that uses ClickFix attacks to hide malware in browser cache images.
- It delivers CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.
- The service handles much of the infrastructure required to conduct the attacks, including hosting the steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads.
- DOUBLECUP customers are responsible for creating and hosting the websites used to display the ClickFix prompts, adding the generated frontend code, and implementing any additional obfuscation or anti-analysis measures.
If the security community is aware of DOUBLECUP and can develop effective countermeasures, it is possible that the service will be shut down, and users will be protected from its threats.
If DOUBLECUP continues to operate and is not detected, it could lead to a significant increase in malware infections, and users may lose sensitive information or have their devices compromised.
