A newly identified Russian loader-as-a-service (LaaS) known as DOUBLECUP has been observed utilizing ClickFix techniques to deliver malware through steganographic PNG images cached in victims’ browsers. This method facilitates the deployment of CountLoader and a previously undocumented remote access trojan (RAT) named DeviceManager.
In this attack sequence, the initial stage involves embedding a PNG image containing hidden malicious code into the browser’s cache. The concealed payload is then extracted and executed, leading to the decryption and in-memory execution of the final malware stage. This decryption process employs a custom SHA-256 stream cipher in Counter (CTR) mode, combined with bitwise XOR operations, using the victim’s public IP address as the cryptographic key.
The payloads associated with DOUBLECUP include CountLoader, which has variants for both Windows and macOS platforms, and DeviceManager. Notably, DeviceManager utilizes EtherHiding techniques to resolve its command-and-control (C2) infrastructure, facilitating communication with the server via HTTP or DNS tunneling.
Active since early June 2026, DOUBLECUP’s developers provide operators with licenses and a client agent to create campaigns and load payloads by embedding the necessary code into their ClickFix landing pages. Each license is uniquely keyed and contains metadata such as the client’s IP address, active days, label, and version, allowing for the orchestration of multiple campaigns per license.
Investigations into DOUBLECUP were initiated following the discovery of an open directory at “213.139.77[.]109:9090,” which contained several testing files later identified as part of the DOUBLECUP license panel.
The Windows GUI client, developed in Go, offers operators functionalities to update configurations, software, and issue commands directly via a Broadcast Pane. Additionally, a Payload Builder Pane enables threat actors to set up commands triggered through ClickFix decoys. This setup involves configuring the domain, slug, steganography method, embed type, archive format, action, and payload URLs.
Upon configuration, an endpoint is generated at “https://{domain}/{slug}/api/config,” which, when accessed, returns DOUBLECUP’s configuration data. This data includes the URL of the steganographic image hosted on the target domain, image size, session endpoint, and browser-specific commands tailored for browsers such as Chrome, Edge, Firefox, Brave, and Opera.
To execute the attack, operators inject the necessary frontend code into their ClickFix site, initiating the following steps:
- Fetching the /api/config endpoint, prefetching the steganographic image, registering a session, and evaluating the browser’s User-Agent string to select the appropriate browser payload.
- Displaying ClickFix instructions, copying the browser-matched command to the victim’s clipboard, and initiating a polling mechanism to execute the final redirect.
Operators have the option to incorporate additional obfuscation or anti-analysis mechanisms into their payloads; however, these enhancements are their responsibility. A Telegram bot (@harrypoterlohBOT) is employed to track client visits, send commands, deliver keys, and receive payload callbacks via a designated DOUBLECUP URL.
Interestingly, the bot is managed by a threat actor known as “johnnysilverhe,” who has also published a suspicious Microsoft Visual Studio Code (VS Code) extension named “Agent IDE” in the official marketplace.
Campaigns leveraging DOUBLECUP have utilized a cluster of fraudulent sites impersonating CRM login pages, including those of NetSuite, Odoo, HubSpot, and Salesforce. These sites embed iframe elements that deliver the loader, which then initiates ClickFix commands. Upon execution, these commands search the browser cache for the PNG image and extract the malicious payload.
The emergence of DOUBLECUP underscores the evolving sophistication of cyber threats, particularly in the realm of loader-as-a-service offerings. By combining ClickFix techniques with steganography and leveraging browser caching mechanisms, attackers can effectively bypass traditional security measures. This development highlights the critical need for organizations to implement comprehensive security strategies that encompass user education, robust endpoint protection, and vigilant monitoring of network activities to detect and mitigate such advanced threats.
