DOUBLECUP: a ClickFix service that hides malware in the browser's image cache

Researchers from the Threat Research Unit at SOCRadar have described a new loader-as-a-service platform called DOUBLECUP, in operation since early June 2026. The service is geared toward ClickFix-style attacks and hides malicious code inside PNG images that the victim's browser stores in its cache. Ultimately, the user is served an updated version of the CountLoader downloader (for Windows and macOS), along with a previously undocumented remote access trojan, DeviceManager, for Windows.

How the service works

DOUBLECUP takes on a substantial share of the infrastructure: hosting the steganographic images, managing sessions and signaling endpoints, issuing encryption keys, and automatically rebuilding the payload. Clients are left to create and host their ClickFix decoy sites, insert the generated code, and, if they wish, add their own obfuscation.

To set up a campaign, the buyer uses a Go application for Windows, where they specify the domain, the URL path, the steganography method, the embedding type, and the location of the payloads. The tool generates a configuration API endpoint and commands tailored for Chrome, Edge, Firefox, Brave, and Opera. SOCRadar discovered the platform while examining an open directory of test files at 213.139.77.109:9090 — the same IP later turned out to host the service's licensing panel.

The lure and execution

The observed campaigns used fake CAPTCHAs on login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce; the malicious code was loaded through embedded iframes. When a victim visits the site, a PNG image is forcibly loaded into the browser cache, after which a phony instruction prompts them to paste and run a command that has been automatically copied to the clipboard.

The command, once executed, searches the cache for the right PNG by its exact file size and uses findstr or certutil to extract and run the first stage hidden inside the image. Next, a fileless dropper is loaded into memory; using the victim's public IPv4 address, it derives the decryption key for the final payload, verifies it against a hardcoded SHA-256 hash, and executes it.

Two payloads

CountLoader gathers data about the infected system, hunts for cryptocurrency wallets and browser extensions, checks for Signal Desktop, and persists via scheduled tasks; it can download and run MSI files, PowerShell modules, and DLLs. The macOS version is built for both Intel and Apple Silicon and uses a LaunchAgent for persistence.

The second payload, DeviceManager, is a modular Python RAT. Outside the CIS countries, it collects detailed information about the machine, and it obtains its command-and-control server address through Ethereum or Polygon smart contracts using the EtherHiding technique, which makes it harder to block. To exfiltrate data and receive commands, the trojan relies on DNS records of types A and TXT.

It is worth noting that steganography has appeared in ClickFix attacks before: Huntress previously described campaigns that hid LummaC2 and Rhadamanthys in the pixel data of PNG files.

Source: Bleeping Computer