A New Breed of Malware Lurks in Browser Cache Images, Threatening Windows and macOS Users
A sophisticated Russian loader-as-a-service named DOUBLECUP has been quietly operating since early June 2026, using a clever technique to hide malicious code in PNG images cached by victims’ browsers. This service, which provides customers with licenses and a Go-based Windows tool for creating malicious campaigns, is responsible for delivering two types of malware: an updated version of CountLoader, targeting both Windows and macOS devices, and a previously undocumented remote access trojan (RAT) called DeviceManager.
DOUBLECUP’s clever approach involves using ClickFix attacks to hide the malicious code in PNG images cached by victims’ browsers. When a victim visits a compromised website, DOUBLECUP registers the session, determines the public IP address of the device, and forces the browser to download and cache a malicious PNG image. The page then displays fake CAPTCHA-style instructions that attempt to convince visitors to paste and run a command automatically copied to their clipboard.
Once executed, the command searches the browser cache for the PNG based on its exact file size and uses the findstr or certutil commands to recover and execute the hidden first-stage payload inside the image. This payload launches a fileless second-stage dropper, which retrieves the victim’s public IPv4 address and uses it to create a decryption key for the final encrypted payload.
The final payloads delivered by DOUBLECUP are CountLoader and DeviceManager. SOCRadar identified an updated version of CountLoader that targets Windows and macOS devices, as well as a previously undocumented DeviceManager RAT. The malware families use different techniques to communicate with attacker-controlled servers: CountLoader uses built-in utilities such as curl, sw_vers, system_profiler, and ioreg, while DeviceManager employs blockchain smart contracts.
DeviceManager is a modular Python-based Windows RAT that collects sensitive information from infected systems in countries not part of the Commonwealth of Independent States (CIS). The malware gathers details such as machine GUID, disk identifier, user SID, hostname, username, operating system version, architecture, installed antivirus software, and domain information. DeviceManager also uses a technique called EtherHiding to retrieve its current IP address.
The DOUBLECUP ClickFix service has significant implications for both individuals and organizations. Users of public computers or those who frequently visit compromised websites are particularly vulnerable. The use of PNG images as a hiding ground for malware highlights the importance of keeping browser software up-to-date, as well as implementing robust security measures to detect and prevent such threats.
In light of this discovery, users should exercise caution when visiting unfamiliar websites, especially if they display fake CAPTCHA-style instructions or prompts to paste commands into their clipboard. Furthermore, organizations should implement regular security audits and monitoring to identify potential ClickFix attacks on their systems.
Source: Bleeping Computer — 2026-08-03