Medium cybersecurity update: New DOUBLECUP ClickFix service hides malware in browser cache images. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. […] New DOUBLECUP ClickFix service hides malware in browser cache images A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. SOCRadar's Threat Research Unit says DOUBLECUP has operated since early June 2026, providing customers with licenses and a Go-based Windows tool for creating malicious campaigns and generating the code operators add to their websites. The service handles much of the infrastructure required to conduct the attacks, including hosting the steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads. DOUBLECUP customers are responsible for creating and hosting the websites used to display the ClickFix prompts, adding the generated frontend code, and implementing any additional obfuscation or anti-analysis measures. SOCRadar discovered DOUBLECUP while investigating an open directory at 213[.]139.77[.]109:9090 that contained test files. The same IP address was later identified as hosting the service's licensing panel. To launch an attack, a DOUBLECUP customer uses the Go-based Windows application to configure the campaign's domain, URL path, steganography method, embed type, execution action, and payload locations.
Technical Details
This generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera. Operators then add DOUBLECUP's code to their ClickFix sites, which retrieves the configuration, preloads the steganographic image into the victim's browser cache, registers the session, selects the command matching the victim's browser, and copies it to the clipboard when the page is opened. In a new report , SOCRadar says it observed DOUBLECUP ClickFix campaigns using fake CAPTCHA prompts on login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce, with the malicious code loaded through embedded iframes. When a victim visits one of these sites, DOUBLECUP registers the session, determines the victim's public IP address, and forces the browser to download and cache a malicious PNG image. The page then displays fake CAPTCHA-style instructions that attempt to convince visitors to paste and run a command automatically copied to their clipboard. Once executed, the command searches the browser cache for the PNG based on its exact file size and uses the findstr or certutil commands to recover and execute the hidden first-stage payload inside the image. The first payload launches a fileless second-stage dropper, which retrieves the victim's public IPv4 address and uses it to create a decryption key for the final encrypted payload. After verifying the decrypted payload against a hardcoded SHA-256 hash, the dropper executes it in memory. SOCRadar says the final payloads are CountLoader and a new DeviceManager RAT.
Security Impact
Organizations using the affected technology should treat the report according to its medium severity classification. SOCRadar identified two malware families delivered through DOUBLECUP, which are an updated version of CountLoader that targets Windows and macOS and what is believed to be a previously undocumented DeviceManager RAT. CountLoader is used to harvest information about infected systems, checks for cryptocurrency wallet applications and browser extensions, determines whether Signal Desktop is installed, and establishes persistence through scheduled tasks. CountLoader can also download and execute files, including MSI packages, PowerShell modules, and DLLs. SOCRadar also recovered a macOS version compiled for Intel and Apple Silicon devices, which installs a LaunchAgent for persistence and uses built-in utilities such as curl, sw_vers, system_profiler, and ioreg to communicate with attacker-controlled servers. DOUBLECUP was also seen delivering the DeviceManager malware, a modular Python-based Windows RAT that uses blockchain smart contracts to determine the IP address of its command-and-control server. In countries not part of the Commonwealth of Independent States (CIS), DeviceManager collects the machine GUID, disk identifier, user SID, hostname, username, operating system version, architecture, installed antivirus software, and domain information. The malware uses a technique known as EtherHiding to retrieve its current C2 address from an Ethereum or Polygon smart contract, which makes it more resistant to disruption attempts.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Medium
- Original source: BleepingComputer
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from BleepingComputer for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
