DOUBLECUP ClickFix Service Hides Malware in Browser Cache PNGs
Summary
SOCRadar says DOUBLECUP has been active since early June 2026, using fake CAPTCHA ClickFix pages and PNG steganography to deliver CountLoader on Windows and macOS and the DeviceManager RAT on Windows.
Key points
- SOCRadar reports that DOUBLECUP customers use a Go-based Windows tool to configure campaigns; the service supplies image hosting, session endpoints, encryption keys, and payload rebuilding.
- Observed campaigns impersonated NetSuite, Odoo, HubSpot, and Salesforce with fake CAPTCHA prompts that copied commands to visitors' clipboards.
- The commands search the browser cache for a PNG by file size and use findstr or certutil to recover and run its hidden payload.
- A fileless dropper derives a decryption key using the victim's public IPv4 address, checks the decrypted payload against a hardcoded SHA-256 hash, and executes it in memory.
- SOCRadar identified CountLoader for Windows and macOS and a previously undocumented DeviceManager RAT for Windows; CountLoader collects system information and can establish persistence and execute downloaded files.
- DeviceManager uses Ethereum or Polygon smart contracts to retrieve its command-and-control address and uses DNS A and TXT records for system information and commands.
Article Details
- Attack Vectors
- ClickFix prompts on fake login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce trick victims into pasting and running commands copied to their clipboard.
- Embedded page code preloads a steganographic PNG into the victim’s browser cache; commands use the image’s exact file size and findstr or certutil to recover and execute its hidden payload.
- A fileless dropper derives a decryption key using the victim’s public IPv4 address, verifies the decrypted payload against a hardcoded SHA-256 hash, and executes it in memory.
- DeviceManager retrieves its C2 address from Ethereum or Polygon smart contracts and uses DNS A and TXT records to exchange system information, commands, payloads, and command output.
- Defensive Notes
- Monitor for suspicious commands that search browser caches for PNG files and use findstr or certutil to extract hidden content.
- Review browser activity and clipboard-related execution for ClickFix-style prompts that direct users to paste and run commands.
- Monitor DNS A and TXT traffic for DeviceManager-like command, payload, and system-information exchanges.
- The article cites testing SIEM and EDR rules with breach-and-attack simulation as a way to identify detection gaps.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 213[.]139[.]77[.]109 | SOCRadar identified this IP hosting a DOUBLECUP test directory and later its licensing panel. |
MITRE ATT&CK
T1027.003 · SteganographyDOUBLECUP conceals payload code inside PNG images cached by victims’ browsers.T1053.005 · Scheduled TaskCountLoader establishes persistence through scheduled tasks.T1059.003 · Windows Command ShellThe supplied command uses Windows command-line utilities, including findstr or certutil, to recover and execute the hidden payload.T1071.004 · DNSDeviceManager uses DNS A and TXT records to retrieve commands and payloads and to send system information and command output.T1082 · System Information DiscoveryDeviceManager collects system details including the operating system version, architecture, hostname, and domain information.T1105 · Ingress Tool TransferCountLoader can download and execute files, including MSI packages, PowerShell modules, and DLLs.T1140 · Deobfuscate/Decode Files or InformationA dropper decrypts the final encrypted payload before executing it in memory.T1204.004 · Malicious Copy and PasteClickFix prompts trick victims into pasting and running a command copied to the clipboard.T1518.001 · Security Software DiscoveryDeviceManager collects information about installed antivirus software.T1543.001 · Launch AgentThe macOS version of CountLoader installs a LaunchAgent for persistence.
Malware
CountLoaderDOUBLECUP is a new Russian loader-as-a-service that uses ClickFix lures and PNG steganography to hide code in browser cache and deliver CountLoader plus the DeviceManager RAT.DeviceManagerDOUBLECUP is a new Russian loader-as-a-service that uses ClickFix lures and PNG steganography to hide code in browser cache and deliver CountLoader plus the DeviceManager RAT.
Products
BraveThis generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera.EdgeThis generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera.Google ChromeThis generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera.macOSDOUBLECUP delivers CountLoader to Windows and macOS and DeviceManager to Windows.Microsoft WindowsDOUBLECUP delivers CountLoader to Windows and macOS and DeviceManager to Windows.Mozilla FirefoxThis generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera.OperaThis generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera.