Russia’s DOUBLECUP ClickFix Service Conceals Malware in Browser Cache Images
A new Russian loader-as-a-service named DOUBLECUP has been discovered using a cunning tactic to deliver malicious code to Windows and macOS devices, as well as a new remote access trojan (RAT) to Windows systems. This service, which has been operating since early June 2026, uses ClickFix attacks to hide malware in PNG images cached by victims’ browsers, ultimately leading to the installation of CountLoader on both platforms and DeviceManager on Windows.
DOUBLECUP’s infrastructure is managed by its operators, who are responsible for creating and hosting websites used to display the ClickFix prompts. These sites add the generated frontend code, as well as any additional obfuscation or anti-analysis measures. The service handles much of the technical heavy lifting, including hosting steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads.
To launch an attack, a DOUBLECUP customer uses a Go-based Windows application to configure the campaign’s domain, URL path, steganography method, embed type, execution action, and payload locations. This generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera.
When a victim visits one of these sites, DOUBLECUP registers the session, determines their public IP address, and forces the browser to download and cache a malicious PNG image. The page then displays fake CAPTCHA-style instructions that attempt to convince visitors to paste and run a command automatically copied to their clipboard. Once executed, this command searches the browser cache for the PNG based on its exact file size and uses the findstr or certutil commands to recover and execute the hidden first-stage payload inside the image.
SOCRadar’s Threat Research Unit identified two malware families delivered through DOUBLECUP: an updated version of CountLoader that targets Windows and macOS, as well as a previously undocumented DeviceManager RAT. CountLoader is used to harvest information about infected systems, checks for cryptocurrency wallet applications and browser extensions, determines whether Signal Desktop is installed, and establishes persistence through scheduled tasks.
DeviceManager, on the other hand, is a modular Python-based Windows RAT that uses blockchain smart contracts to determine the IP address of its command-and-control server. In countries not part of the Commonwealth of Independent States (CIS), DeviceManager collects machine-specific data such as GUID, disk identifier, user SID, hostname, username, operating system version, architecture, installed antivirus software, and domain information.
The use of steganographic images to conceal malware in browser cache is a clever tactic that can evade traditional detection methods. To protect against these types of attacks, it’s essential for users to exercise caution when visiting unfamiliar websites and avoid pasting commands into their clipboard without verifying the source. Additionally, organizations should ensure their security measures are up-to-date, including anti-malware software, firewalls, and intrusion detection systems. By being vigilant and proactive, individuals can significantly reduce their risk of falling victim to these types of attacks.
Source: Bleeping Computer — 2026-08-03