DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
DOUBLECUP is a Russian loader-as-a-service (LaaS) active since early June 2026 that uses ClickFix lures to stage steganographic PNG images in browser caches for malware delivery The attack chain employs a two-stage process: first dropping a hidden-content PNG into the browser cache, then decrypting the final payload in memory using a custom SHA-256 stream cipher in CTR mode with the victim's public IP as the cryptographic key Payloads include CountLoader (Windows/macOS) with cryptocurrency walle
Analysis
TL;DR
- DOUBLECUP is a Russian loader-as-a-service (LaaS) active since early June 2026 that uses ClickFix lures to stage steganographic PNG images in browser caches for malware delivery
- The attack chain employs a two-stage process: first dropping a hidden-content PNG into the browser cache, then decrypting the final payload in memory using a custom SHA-256 stream cipher in CTR mode with the victim's public IP as the cryptographic key
- Payloads include CountLoader (Windows/macOS) with cryptocurrency wallet auditing and Signal detection capabilities, and DeviceManager, a previously undocumented Python-based RAT using EtherHiding for C2 resolution via HTTP or DNS tunneling
- The service provides operators with a Go-based GUI client, license management, a Payload Builder Pane, and a Telegram bot (@harrypoterlohBOT) for campaign coordination
- Campaigns impersonate legitimate CRM platforms (NetSuite, Odoo, HubSpot, Salesforce) via fake login pages with embedded iframes to deliver the initial ClickFix decoy
Why It Matters
This represents a significant evolution in LaaS-based attack operations, combining social engineering (ClickFix), steganography, and environmental keying into a sophisticated, operator-friendly delivery pipeline. The use of a victim's public IP address as a cryptographic key for payload decryption is a notable anti-analysis technique that complicates sandboxed malware analysis and threat intelligence gathering. For security practitioners, this highlights the growing convergence of browser-based attack vectors with advanced obfuscation methods in commercial malware ecosystems.
Technical Details
- ClickFix + Steganography Delivery: The first stage drops a steganographic PNG into the browser cache, then retrieves hidden content (JavaScript, VBScript, or PowerShell) to execute the second stage. Operators inject frontend code that fetches
/api/config, prefetches the image, registers a session, and uses browser-specific commands copied to the victim's clipboard. - Environmental Keying: The second stage decrypts the final payload in memory using a custom SHA-256 stream cipher in Counter (CTR) mode, with the victim's public IPv4 address passed through a key derivation function as the cryptographic seed. Decryption fails on any machine other than the intended target.
- CountLoader Capabilities: Windows and macOS variants establish persistence via scheduled tasks, audit browser extensions for cryptocurrency wallets, detect Signal desktop installation, scan for browser .LNK shortcuts (dead code), connect to C2 for system metadata exfiltration, execute secondary payloads (EXE, DLL, MSI, HTA), and clean up forensic evidence.
- DeviceManager RAT: A modular Python-based RAT utilizing EtherHiding to resolve C2 infrastructure via blockchain dead drop resolution, communicating over HTTP or DNS tunneling.
- Operator Infrastructure: Go-based Windows GUI client with Broadcast Pane and Payload Builder Pane; license system with unique keys tracking client IP, active days, label, and version; Telegram bot for command delivery and callback tracking; open directory leak at
213.139.77[.]109:9090:9090exposed testing files.
Industry Insight
- The DOUBLECUP infrastructure demonstrates how LaaS platforms are lowering the barrier to sophisticated multi-stage attacks, enabling less technical threat actors to deploy advanced anti-analysis techniques like environmental keying and steganographic caching. Security teams should prioritize monitoring for anomalous browser cache activity and unusual PNG file sizes in enterprise environments.
- The integration of ClickFix abuse with CRM impersonation sites suggests a targeted focus on business users with access to sensitive platforms. Organizations should enforce strict browser security policies, implement application whitelisting, and educate users about ClickFix-style social engineering lures, particularly those referencing popular SaaS tools.
- The use of blockchain-based dead drop resolvers (EtherHiding) by DeviceManager reflects an emerging trend of leveraging decentralized infrastructure for C2 resilience. Threat intelligence programs should expand monitoring to include blockchain transaction patterns and DNS tunneling indicators as part of comprehensive C2 detection strategies.
Disclaimer: The above content is generated by AI and is for reference only.