Ethical Hacking News
A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been discovered to be utilizing ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and DeviceManager RATs. The attack chain ends with the stager reconstructing the final payload and executing it, and demonstrates how threat actors are using ClickFix lures to deliver malware-laced PNG images into victims' browser cache.
The DOUBLECUP Russian loader-as-a-service has been discovered to be utilizing ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and DeviceManager RATs.The attack chain ends with the stager reconstructing the final payload and executing it, using steganography and environmental keying to bypass defenses.CountLoader is an updated Windows and macOS version of malware that comes with new capabilities, including persistence using scheduled tasks and audit installed browser extensions for cryptocurrency wallets.DeviceManager is a modular Python-based RAT that utilizes the blockchain as a dead drop resolver to fetch the C2 server details.SOCRadar noted that DOUBLECUP highlights the expanding reach of ClickFix campaigns, providing threat actors with a low-friction, highly reliable payload delivery pipeline.
The cybersecurity world has recently been shaken by the emergence of a new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP, which has been discovered to be utilizing ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager.
According to SOCRadar, a cybersecurity firm that conducted an investigation into the DOUBLECUP LAAS, it first sprang forth from an open directory at "213.139.77[.]109:9090" that left several testing files which were later identified as part of the DOUBLECUP license panel.
This new Russian loader-as-a-service has been found to be utilizing ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and DeviceManager RATs. This is done by first dropping a steganographic PNG image into the browser's cache, retrieving its hidden content, and executing the second stage.
The second stage then decrypts the final payload in memory via a custom SHA-256 stream cipher in Counter (CTR) mode along with bitwise XOR using the victim's public IP address as the cryptographic key. This results in payloads delivered via the loader service including CountLoader, with variants for both Windows and macOS, and DeviceManager, which utilizes EtherHiding to resolve its command-and-control (C2) infrastructure and communicate with the server over HTTP or DNS tunneling.
The DOUBLECUP LAAS is assessed to be active since early June 2026, with the core developers providing operators with licenses and a client agent to help create campaigns and load payloads by embedding the required code in their ClickFix landing pages. Each license comes with a unique key and contains metadata including the client's IP address, active days, label, and version. Multiple campaigns can be orchestrated per license.
SOCRadar noted that its investigation sprang forth from an open directory at "213.139.77[.]109:9090" which left several testing files which were later identified as part of the DOUBLECUP license panel. The Go-based Windows GUI client also offers operators the ability to update configurations, update the software, and issue commands directly via a Broadcast Pane.
A Payload Builder Pane allows threat actors to set up the command that's triggered via a ClickFix decoy. This involves setting up the domain, slug, steganography method, embed type, archive format, action, and payload URLs. A configuration endpoint at https://{domain}/{slug}/api/config returns DOUBLECUP's configuration data which includes the steganographic image URL hosted on the target domain, image size, the session endpoint, and browser-specific commands tailored for Chrome, Edge, Firefox, Brave, and Opera.
The attack also requires operators to inject necessary frontend code onto their ClickFix site to trigger the malicious code. This involves fetching the /api/config endpoint, prefetching the steganographic image, registering a session, and evaluating the browser User-Agent string to select the appropriate browser payload.
Displaying ClickFix instructions, copying the browser-matched command to the victim's clipboard, and initiating a polling mechanism to execute the final redirect are all part of this process. Operators can opt to incorporate additional obfuscation or anti-analysis mechanisms into their payloads but these extra steps remain solely their responsibility.
A Telegram bot (@harrypoterlohBOT) is used to track client visits, send commands, deliver keys, and receive payload callbacks via a designated DOUBLECUP URL. Interestingly, the bot is managed by a threat actor named "johnnysilverhe," who has also published a suspicious Microsoft Visual Studio Code (VS Code) extension named Agent IDE in the official marketplace.
Campaigns using DOUBLECUP have leveraged a cluster of bogus sites impersonating CRM login pages, including NetSuite, Odoo, HubSpot, and Salesforce, to deliver the loader via embedded iframe elements. These elements pave the way for ClickFix commands that, upon execution, search the browser cache for the PNG image and extract from it malicious JavaScript, VBScript, or PowerShell to launch the next-stage component.
The C2 server is notified of a successful infection at this point. The second-stage then acts as a dropper to deploy an encrypted payload and then redirect the victim to a destination page. The payload employs environmental keying as an anti-analysis technique to ensure that it's unpacked only on the victim's machine.
This is accomplished by passing the victim machine's public IPv4 address as a seed into a key derivation function to generate the cryptographic key necessary to decode the payload. The decryption process fails on any machine other than the intended target, as it would yield the wrong key.
The attack chain ends with the stager reconstructing the final payload and executing it. One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks, audit installed browser extensions for cryptocurrency wallets, and profile the host to check if Signal's desktop app is installed.
CountLoader also includes a function that scans the desktop and start menu for shortcuts (.LNK files) belonging to popular web browsers. It rewrites the target of these shortcuts so that when the user double-clicks their browser shortcut, it secretly launches the intended browser and the RAT in the background.
However, this function is never invoked, indicating it may be an incomplete feature or dead code under development. The primary objective of CountLoader is to connect to a C2 server, gather system metadata, and exfiltrate it, and await further tasks from the operator, allowing it to run secondary executables, DLLs, MSI, or HTML Application (HTA) files.
There exists an equivalent macOS version of CountLoader that features the same functionality as its Windows PowerShell variant but adapts its persistence and reconnaissance methods for Apple's desktop operating system. The second payload delivered via the DOUBLECUP infrastructure is a modular Python-based RAT codenamed DeviceManager.
DeviceManager utilizes the blockchain as a dead drop resolver to fetch the C2 server details, a technique known as EtherHiding. Specifically, the trojan dynamically resolves its active C2 nodes via Ethereum/Polygon smart contracts before establishing C2 communications.
DeviceManager is distributed as a Delphi-compiled Inno Setup installer that embeds the encrypted payload. Once launched, it extracts a full embedded Python environment to spawn the Python malware. At the same time, it deliberately avoids executing on machines that resolve to Commonwealth of Independent States (CIS) language locales.
If a target CIS language is detected, DeviceManager executes a self-deletion routine: it removes its scheduled task, deletes its installation directory via cmd.exe, and terminates process execution. The malware then proceeds to collect extensive device information, use EtherHiding to extract the C2 server ("91.92.240[.]100"), and communicate with it using DNS or HTTP to exfiltrate system data, poll for tasks, download payloads, send command execution results, and report task status.
DeviceManager is equipped to run PowerShell and Python scripts, as well as pipe operator-issued commands into "cmd.exe." SOCRadar noted that DOUBLECUP highlights the expanding reach of ClickFix campaigns, providing threat actors with a low-friction, highly reliable payload delivery pipeline. Built with evasion at its core, DOUBLECUP leverages steganography and environmental keying to bypass defenses.
CountLoader evades process monitoring by copying and header-patching legitimate Windows binaries, while DeviceManager utilizes smart contracts on the Ethereum/Polygon blockchains for resilient C2 infrastructure resolution.
The attack described in this article demonstrates how threat actors are using ClickFix lures as a way to deliver malware-laced PNG images into victims' browser cache. The use of steganography and environmental keying makes it difficult for security software to detect these threats.
The DOUBLECUP LAAS has been found to be utilizing ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and DeviceManager RATs. This new Russian loader-as-a-service has been assessed to be active since early June 2026, with the core developers providing operators with licenses and a client agent to help create campaigns and load payloads by embedding the required code in their ClickFix landing pages.
The attack chain ends with the stager reconstructing the final payload and executing it. One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks, audit installed browser extensions for cryptocurrency wallets, and profile the host to check if Signal's desktop app is installed.
CountLoader also includes a function that scans the desktop and start menu for shortcuts (.LNK files) belonging to popular web browsers. It rewrites the target of these shortcuts so that when the user double-clicks their browser shortcut, it secretly launches the intended browser and the RAT in the background.
The primary objective of CountLoader is to connect to a C2 server, gather system metadata, and exfiltrate it, and await further tasks from the operator, allowing it to run secondary executables, DLLs, MSI, or HTML Application (HTA) files. There exists an equivalent macOS version of CountLoader that features the same functionality as its Windows PowerShell variant but adapts its persistence and reconnaissance methods for Apple's desktop operating system.
The second payload delivered via the DOUBLECUP infrastructure is a modular Python-based RAT codenamed DeviceManager, which utilizes the blockchain as a dead drop resolver to fetch the C2 server details. Specifically, the trojan dynamically resolves its active C2 nodes via Ethereum/Polygon smart contracts before establishing C2 communications.
DeviceManager is distributed as a Delphi-compiled Inno Setup installer that embeds the encrypted payload. Once launched, it extracts a full embedded Python environment to spawn the Python malware. At the same time, it deliberately avoids executing on machines that resolve to Commonwealth of Independent States (CIS) language locales.
If a target CIS language is detected, DeviceManager executes a self-deletion routine: it removes its scheduled task, deletes its installation directory via cmd.exe, and terminates process execution. The malware then proceeds to collect extensive device information, use EtherHiding to extract the C2 server ("91.92.240[.]100"), and communicate with it using DNS or HTTP to exfiltrate system data, poll for tasks, download payloads, send command execution results, and report task status.
DeviceManager is equipped to run PowerShell and Python scripts, as well as pipe operator-issued commands into "cmd.exe." SOCRadar noted that DOUBLECUP highlights the expanding reach of ClickFix campaigns, providing threat actors with a low-friction, highly reliable payload delivery pipeline. Built with evasion at its core, DOUBLECUP leverages steganography and environmental keying to bypass defenses.
CountLoader evades process monitoring by copying and header-patching legitimate Windows binaries, while DeviceManager utilizes smart contracts on the Ethereum/Polygon blockchains for resilient C2 infrastructure resolution.
Related Information:
https://www.ethicalhackingnews.com/articles/New-DoubleCup-Loader-As-A-Service-Used-to-Deliver-CountLoader-and-DeviceManager-RATs-ehn.shtml
https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html
Published: Tue Aug 4 05:59:55 2026 by llama3.2 3B Q4_K_M
