DOUBLECUP Service Hides Malware in Browser Cache Images via ClickFix Attacks
A new Russian loader-as-a-service, DOUBLECUP, is leveraging ClickFix attacks to conceal malware within browser cache images, delivering CountLoader and a new RAT called DeviceManager.
A sophisticated new Russian malware-as-a-service, dubbed DOUBLECUP, has emerged, employing a novel technique to hide malicious payloads within seemingly innocuous PNG images stored in victims' browser caches. This loader-as-a-service utilizes ClickFix attacks, a method that often involves social engineering prompts like fake CAPTCHAs, to trick users into executing commands that ultimately deploy malware. The primary targets of DOUBLECUP campaigns are Windows and macOS systems, with the service delivering the CountLoader malware to both, and a new, previously undocumented remote access trojan (RAT) named DeviceManager specifically to Windows machines.
Operated since at least early June 2026, DOUBLECUP provides its customers with licenses and a Go-based Windows tool for crafting malicious campaigns. The service handles significant portions of the attack infrastructure, including hosting the steganographically encoded PNG images, managing command-and-control (C2) endpoints, distributing encryption keys, and automatically rebuilding payloads. This allows customers to focus on the social engineering aspect, such as creating and hosting websites that display convincing ClickFix prompts, embedding the generated frontend code, and implementing additional obfuscation techniques.
Researchers at SOCRadar's Threat Research Unit discovered DOUBLECUP while investigating an open directory containing test files, which also hosted the service's licensing panel. The attack flow begins when a DOUBLECUP customer uses the provided application to configure campaign details such as the domain, URL path, steganography method, embed type, execution action, and payload locations. This configuration generates an API endpoint that returns crucial information, including the steganographic image URL, file size, session endpoint, and browser-specific commands for popular browsers like Chrome, Edge, Firefox, Brave, and Opera.
When a victim visits a compromised website featuring DOUBLECUP's code, the service registers the session, identifies the victim's public IP address, and prompts the browser to download and cache a malicious PNG image. The webpage then presents fake CAPTCHA-style instructions, attempting to persuade the user to paste and execute a command that has been automatically copied to their clipboard. This command is designed to locate the specific malicious PNG file within the browser's cache based on its exact file size.
Once the command is executed, it uses Windows utilities like findstr or certutil to extract the hidden first-stage payload from the PNG image. This extracted payload then launches a fileless second-stage dropper, which proceeds to retrieve the victim's public IPv4 address. This IP address is used to construct a decryption key for the final encrypted payload. After verifying the decrypted payload against a hardcoded SHA-256 hash, the dropper executes it directly in memory, thus avoiding disk-based artifacts.
Two distinct malware families have been identified as final payloads delivered by DOUBLECUP. The first is an updated variant of CountLoader, which targets both Windows and macOS systems. CountLoader is designed for information harvesting, checking for cryptocurrency wallet applications and browser extensions, detecting Signal Desktop installation, and establishing persistence via scheduled tasks. It also possesses the capability to download and execute additional files, including MSI packages, PowerShell modules, and DLLs.
The second payload is the newly discovered DeviceManager RAT, a modular, Python-based malware specifically targeting Windows. DeviceManager exhibits a unique C2 communication method, leveraging blockchain smart contracts on Ethereum or Polygon to dynamically determine its C2 server's IP address, a technique known as EtherHiding. This makes the RAT highly resistant to takedown efforts. It communicates using DNS A and TXT records to exfiltrate system information, receive commands, download further payloads, and send command output back to its operators.
This deployment of steganography within browser cache images is not entirely unprecedented, as similar techniques have been observed in campaigns distributing other malware like LummaC2 and Rhadamanthys. However, the comprehensive loader-as-a-service model offered by DOUBLECUP, coupled with the delivery of both a known loader and a novel RAT, presents a significant and evolving threat to organizations and individuals alike.