DOUBLECUP , a new Russian-origin loader -as-a-service (LaaS) exploits ClickFix techniques and hidden PNG images to deliver two dangerous malware: CountLoader and a previously unpublished remote access trojan called DeviceManager . According to a technical report by SOCRadar , the service has been active since early June 2026 and represents a sophisticated evolution in the field of malware-as-a-service attacks. DOUBLECUP stands out for its innovative use of steganography combined with browser cache abuse, making it extremely difficult to detect
See also: ClickFix: Analysis of 3,000 payloads reveals API-driven malware
DOUBLECUP is part of a broader shift toward malware delivery as a service , where attackers rent a complete attack platform rather than building the entire chain themselves. The service provides its customers — so-called “operators” — with licenses, campaign creation tools, image hosting infrastructure, encryption keys, session management, and automatic payload reconstruction. Each license contains metadata such as the customer’s IP address , active days, label, and version, and multiple campaigns can be managed per license. SOCRadar ’s investigation began with an open directory at 213.139.77[.]109:9090 , where several test files were found that are part of DOUBLECUP ’s license panel .
DOUBLECUP campaigns have leveraged a cluster of fake websites that mimic CRM login pages from well-known companies, including NetSuite , Odoo , HubSpot , and Salesforce . The malicious code is embedded via iframe elements , paving the way for ClickFix commands that, when executed, search the browser cache for the PNG image and extract malicious JavaScript , VBScript, or PowerShell from it to launch the next stage. This technique is particularly insidious, as it exploits the browser’s natural behavior of storing images locally.
How DOUBLECUP works: Steganography and browser cache
The technical operation of DOUBLECUP is multi-layered and sophisticated. In the first stage, the malicious page forces the browser to download and cache a PNG image containing hidden malicious content via steganography . The code then retrieves this hidden content and executes the second stage of the attack. The second stage decrypts the final payload in memory using a custom SHA-256 cryptographic algorithm in Counter mode (CTR) combined with bitwise XOR , using the victim’s public IP address as the cryptographic key — a technique known as environmental keying .
The Go-based Windows client with a graphical interface offers operators the ability to update settings, update software, and issue commands directly through a Broadcast Pane . A Payload Builder Pane allows threat actors to configure the command triggered by the ClickFix decoy, including configuring the domain, slug, steganography method, embed type, file format, action, and payload URLs. The system automatically creates a configuration endpoint at https://{domain}/{slug}/api/config , which returns DOUBLECUP configuration data , including the steganographic image URL, image size, session endpoint, and commands specific to Chrome , Edge , Firefox , Brave , and Opera .
A Telegram bot named @harrypoterlohBOT is used to track customer visits, send commands, deliver keys, and receive payload callbacks via a special DOUBLECUP. Notably, the bot is operated by a threat actor named “johnnysilverhe,” who has also published a suspicious extension for Microsoft Visual Studio Code named Agent IDE on the official marketplace. This suggests that the creators of DOUBLECUP may also maintain a presence in other malware distribution channels.
DOUBLECUP: CountLoader and DeviceManager RAT — The final payloads
Payloads delivered via the DOUBLECUP include CountLoader, with variants for both Windows and macOS, and the DeviceManager RAT, which uses EtherHiding to resolve the command-and-control (C2) and communicates with the server via HTTP or DNS tunneling. EtherHiding is a technique that leverages blockchain to hide C2 addresses, making them extremely difficult to block. The DeviceManager RAT is a previously undisclosed remote access tool, suggesting that the creators of DOUBLECUP are investing in proprietary malware development.
See also: Ghost CMS vulnerability: 700+ sites compromised and ClickFix attacks
DOUBLECUP is part of a broader trend that has been observed in recent months. Microsoft reported an increase in ACR Stealer attacks that also relied on ClickFix , using WebDAV , MSHTA , and in one case a steganographic JPEG to hide payloads in an image and execute them in memory. CrowdStrike has tracked HijackLoader ’s evolution towards more complex, layered behavior and dynamic API resolution , demonstrating the broader ecosystem of loaders that DOUBLECUP now fits into . The use of environmental keying and per-victim session management suggests that operators are trying to make payload retrieval more selective and harder to replicate outside of the intended browser context.
The DOUBLECUP service represents a significant evolution in the way cybercriminals organize their attacks, providing a comprehensive toolkit that significantly lowers the technical barrier to entry for new operators. The public report does not yet provide a confirmed number of victims or financial impact, but the campaign targets users of large enterprise SaaS platforms , suggesting an enterprise orientation.
How to protect yourself from DOUBLECUP and similar attacks
Organizations can take specific steps to reduce the risk from DOUBLECUP and similar threats. First and foremost, it is critical to educate users to be suspicious of copy-paste execution prompts , fake CAPTCHA pages , and “verification” steps, especially when the page asks them to execute commands in a terminal or browser command line. Additionally, it is recommended to restrict or monitor access to browser cache directories and investigate unusual PNG image downloads from login-related pages.
From a technical perspective, security teams should use EDR to detect in-memory decryption, unexpected PowerShell, MSHTA, rundll32 , or other LOLBin-style execution paths that often accompany loader campaigns. Implementing web filtering, application control, and script blocking policies can significantly reduce the risk of malicious script execution from fake SaaS. Finally, if a breach is suspected, it is important to immediately collect browser cache objects, process trees, command line history, and memory logs, as the second stage decrypts exclusively in memory and does not leave easily detectable traces on disk.
See also: CountLoader: Russian hackers use new malware loader
DOUBLECUP is a prime example of the evolution of modern cyberthreats: it combines social engineering, sophisticated encryption techniques, abuse of legitimate browser features, and infrastructure as a service to create a multi-layered threat that is difficult to detect and block. Monitoring developments by organizations like SOCRadar and promptly implementing security recommendations are essential to addressing this emerging threat.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
