DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

Severity

Medium

Detail

Researchers have uncovered DOUBLECUP, a Russian Loader-as-a-Service (LaaS) that uses ClickFix lures to deliver malware. It hides malicious code inside PNG images stored in the browser cache before deploying CountLoader or the newly discovered DeviceManager RAT.

The framework uses steganography, environmental keying, and blockchain-based command-and-control (C2) techniques to evade detection and maintain reliable malware delivery.

How?

Victims are redirected to fake CRM login pages that display ClickFix instructions, convincing them to execute a malicious command. The command downloads a PNG image containing hidden malicious code, which is extracted from the browser cache and used to decrypt the final payload in memory using the victim’s public IP address as the key. This ensures the malware only runs on the intended target.

The attack then installs either CountLoader, which establishes persistence, collects system information, and downloads additional malware, or DeviceManager RAT, which communicates with its C2 server using blockchain-based EtherHiding and enables remote command execution, data exfiltration, and further payload delivery.

Conclusion

DOUBLECUP highlights the growing use of ClickFix social engineering combined with stealth techniques such as steganography and environmental keying to deliver malware.

Organizations should train users to avoid executing unsolicited commands, restrict script execution, and monitor endpoints for suspicious browser cache activity, persistence mechanisms, and unusual outbound network connections.

Source

https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html