DOUBLECUP is a newly observed malware loader-as-a-service (LaaS) attributed to Russian operators, and it stands out for its reliance on cached PNG payload delivery. Instead of sending a clear malicious file directly, the service uses ClickFix-style interactions to stage hidden content in images that end up in a victim’s browser cache. From there, it retrieves, decrypts, and executes the next stage—ultimately delivering tools such as CountLoader and a modular remote access trojan called DeviceManager.
Security researchers described a multi-step chain where the first stage plants a steganographic PNG into the browser cache, then extracts the hidden payload content and runs the second stage. The second-stage logic decrypts the final payload in memory, using a stream-cipher approach tied to information from the victim—making the process harder to replay elsewhere.
How DOUBLECUP achieves cached PNG payload delivery
The initial phase centers on a steganographic PNG lure. Operators set up their ClickFix landing pages so the victim’s browser performs requests that lead to a cached image containing concealed data. In the analysis, the approach is summarized as: the first stage drops a hidden PNG into cache, retrieves its concealed content, and executes the second stage.
What makes this method particularly useful for attackers is that it leverages normal browser behavior. When users interact with decoy content generated through ClickFix, the browser carries out the scripted steps that prefetch and store the relevant image. Later, the attacker’s logic searches the cache for that PNG and extracts embedded material from it.
Decryption and in-memory execution tied to the victim
After extracting the concealed information, DOUBLECUP decrypts the final payload in memory. Researchers reported that the second stage performs decryption using a custom SHA-256-based stream cipher operating in Counter (CTR) mode, combined with bitwise XOR operations.
A key detail is how the cryptographic key is derived. DOUBLECUP uses the victim’s public IP address as part of the keying material. In practical terms, that means the decryption step is designed to fail when executed on a different machine or context—because the derived key would not match the intended target.
This “environment-aware” approach acts as an anti-analysis measure. It limits the value of generic samples and replay attempts by defenders, since the payload is constructed to align its decoding process with the intended environment.
What payloads DOUBLECUP delivers
DOUBLECUP provides operators with a pipeline that can deliver multiple malware families.
CountLoader variants for Windows and macOS
One delivered payload is CountLoader, available in variants for both Windows and macOS. The loader is designed not only to execute additional code, but also to support persistence and reconnaissance.
For Windows, the analysis described new capabilities including persistence via scheduled tasks. CountLoader also audits installed browser extensions for cryptocurrency-wallet-related tooling, and it profiles the host to check whether the desktop application for Signal is installed.
It also includes logic aimed at browser shortcuts: it scans the desktop and start menu for shortcut files (.LNK) associated with popular browsers and rewrites them so that double-clicking the shortcut can launch the attacker’s intended browser and the RAT component in the background. Notably, investigators reported that this shortcut-rewrite function is not invoked, suggesting it may be incomplete functionality or dead code.
At a higher level, CountLoader’s main goal is to contact its command-and-control (C2) infrastructure, collect system metadata, exfiltrate it, and then wait for operator instructions. It can run secondary executables and other formats such as DLLs, MSI files, and HTA (HTML Application), and it can download and unpack compressed archives to run the primary binary contained within.
There is also an equivalent macOS version. It mirrors the Windows loader’s overall purpose but adapts persistence and reconnaissance steps for Apple’s desktop operating system.
DeviceManager modular Python RAT
The second payload family delivered through DOUBLECUP is DeviceManager, a modular, Python-based remote access trojan. Unlike simpler C2 discovery methods, DeviceManager uses a technique known as EtherHiding, which relies on blockchain infrastructure to resolve C2 details.
Researchers reported that DeviceManager dynamically resolves active C2 nodes via smart contracts deployed on Ethereum/Polygon before it establishes communications. This can help keep C2 infrastructure resilient and harder to map using conventional static indicators.
DeviceManager was described as being distributed via a Delphi-compiled Inno Setup installer that contains an encrypted payload. When executed, it extracts a full embedded Python environment and spawns the Python malware from within.
DeviceManager also includes a language-based targeting gate. It deliberately avoids execution on machines that resolve to Commonwealth of Independent States (CIS) locales. If a target CIS language is detected, it runs a self-deletion routine: removing its scheduled task, deleting its installation directory using cmd.exe, and terminating execution.
Once running, DeviceManager collects extensive device information. It then uses EtherHiding to extract the C2 server details and communicates with the server using DNS or HTTP to exfiltrate data, poll for tasks, download payloads, send command execution results, and report task status. It is also capable of executing PowerShell and Python scripts, and it can pipe operator-issued commands into cmd.exe.
How operators manage and configure the service
DOUBLECUP appears to have been active since early June 2026. The core developers provide operators with licenses and a client agent that helps them create campaigns and load payloads. Each license includes a unique key and metadata such as the client’s IP address, active days, a label, and a version. Multiple campaigns can be orchestrated using a single license.
During the investigation, researchers traced the service’s presence to an open directory at an IP-based endpoint that exposed testing files later linked to DOUBLECUP’s license panel.
The service is also supported by a Go-based Windows GUI client. It enables operators to update configurations, update the software, and issue commands via a Broadcast Pane. It also includes a Payload Builder Pane where threat actors define the ClickFix-decoy trigger behavior.
Building a campaign involves configuring parameters such as the domain, slug, steganography method, embed type, archive format, action, and payload URLs. Based on these inputs, the system generates a configuration endpoint in the form of https://{domain}/{slug}/api/config. A GET request to that endpoint returns configuration data that includes the steganographic image URL hosted on the target domain, the image size, session endpoint details, and browser-specific command logic tailored for major browsers such as Chrome, Edge, Firefox, Brave, and Opera.
ClickFix steps that trigger cached image extraction
To make the campaign work end-to-end, operators must inject the necessary frontend code into their ClickFix sites. Investigators described the flow as including fetching the configuration endpoint, prefetching the steganographic image, registering a session, and selecting the appropriate browser payload based on the browser’s User-Agent string.
After that, the decoy content displays ClickFix instructions. The logic then copies a browser-matched command to the victim’s clipboard and initiates a polling mechanism that ultimately triggers a final redirect.
At execution time, the chain instructs the browser logic to search for the PNG already stored in cache. It then extracts the malicious JavaScript, VBScript, or PowerShell content from that image to launch the next stage.
Operators may optionally add further obfuscation or anti-analysis measures within their payloads. However, the analysis emphasized that these extras are controlled by the operator rather than being mandatory service behavior.
Monitoring, command delivery, and the operator tooling
Researchers also noted the use of a Telegram bot for activity tracking and control. The bot is referenced as being used to track client visits, send commands, distribute keys, and receive payload callbacks via a designated DOUBLECUP URL.
Interestingly, the bot was associated with a threat actor profile name linked to another public artifact: a suspicious Microsoft Visual Studio Code extension. That extension was posted to the official marketplace, illustrating how the operator ecosystem may blend real-world distribution channels with malicious infrastructure.
Decoy infrastructure and multi-step browser staging
In observed campaigns, DOUBLECUP used clusters of bogus sites impersonating CRM login pages, including well-known platforms. These decoy pages were leveraged to deliver the loader via embedded iframe elements. Once the ClickFix logic ran, it followed the cached PNG extraction and decoding steps described earlier, setting up the path to the loader’s second stage.
When the next stage runs, it acts as a dropper: it deploys an encrypted payload, then redirects the victim to a destination page. Investigators also reported the use of environmental keying at this point, so the payload is intended to unpack correctly only on the targeted machine.
Why this matters for defenders
DOUBLECUP highlights how ClickFix campaigns can evolve into a low-friction delivery pipeline. The cached PNG payload delivery design reduces reliance on direct downloading of obvious executables and instead piggybacks on browser caching and scripted extraction.
Combined with in-memory decryption keyed to victim-specific details, the approach increases the effort required for analysts and defenders to reproduce the exact runtime behavior on their own systems. Meanwhile, the inclusion of robust modular tooling—like CountLoader’s persistence and reconnaissance functions and DeviceManager’s blockchain-assisted C2 discovery—suggests that operators expect long-lived control rather than one-off infections.
Overall, the chain reflects a clear theme: steganography, environmental keying, and resilient infrastructure discovery working together to bypass straightforward detection and complicate incident response.
Conclusion
DOUBLECUP demonstrates a modern loader-as-a-service model built around browser-side staging and hidden payload delivery. By embedding malicious content in steganographic images that land in cache, then decrypting and executing second-stage malware that is keyed to the victim’s environment, the service delivers CountLoader and DeviceManager with a high degree of automation.
For security teams, the core takeaway is to treat browser cache interactions and steganographic image handling as meaningful signals, especially when paired with ClickFix-style decoy workflows and environment-sensitive decryption behavior.
Source: https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html
