New DOUBLECUP ClickFix service hides malware in browser cache images

DOUBLECUP is a Russian loader-as-a-service (LaaS) that has operated since early June 2026. It uses ClickFix social engineering attacks combined with steganography to hide malicious code inside PNG images that are cached by victims' browsers. The service provides customers with a Go-based Windows tool for creating malicious campaigns and generating frontend code to embed in attacker-controlled websites. The infrastructure includes hosting steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads. Attack flow: (1) Victim visits a fake site impersonating NetSuite, Odoo, HubSpot, or Salesforce via embedded iframes displaying fake CAPTCHA prompts. (2) DOUBLECUP registers the session, determines the victim's public IP, and forces the browser to download and cache a malicious PNG image. (3) The fake CAPTCHA instructs the victim to paste and execute a command that was silently copied to the clipboard. (4) The command searches the browser cache for the PNG by exact file size, then uses 'findstr' or 'certutil' to recover and execute the hidden first-stage payload inside the image. (5) The first payload launches a fileless second-stage dropper, which retrieves the victim's public IPv4 address to create a decryption key for the final encrypted payload. (6) After verifying the decrypted payload against a hardcoded SHA-256 hash, it is executed in memory. Final payloads delivered are CountLoader and DeviceManager RAT. CountLoader harvests system information, checks for cryptocurrency wallet apps and browser extensions, checks for Signal Desktop, establishes persistence via scheduled tasks, and can download/execute MSI packages, PowerShell modules, and DLLs. A macOS version is compiled for Intel and Apple Silicon and installs a LaunchAgent for persistence using curl, sw_vers, system_profiler, and ioreg. DeviceManager is a modular Python-based Windows RAT that uses EtherHiding — blockchain smart contracts on Ethereum or Polygon — to dynamically retrieve its C2 server address, making it resilient to takedowns. It collects machine GUID, disk identifier, user SID, hostname, username, OS version, architecture, installed AV software, and domain info. It uses DNS A and TXT records to steal data, retrieve commands, download payloads, and exfiltrate output. Browsers targeted include Chrome, Edge, Firefox, Brave, and Opera. The service skips systems in CIS (Commonwealth of Independent States) countries.