Security firm SOCRadar has documented a new Russian loader-as-a-service called DOUBLECUP that hides malicious code inside PNG images cached by victims’ browsers and delivers it through ClickFix prompts. The service, active since early June, deploys CountLoader on Windows and macOS and a new modular RAT called DeviceManager on Windows, according to SOCRadar’s Threat Research Unit.
DOUBLECUP operates a commercial model: it offers licenses and a Go-based Windows tool for building campaigns and generating the code operators add to their websites. The service handles the infrastructure — hosting steganographic PNG images, managing session and signal endpoints, providing encryption keys, and auto-rebuilding payloads — while customers host the ClickFix prompt websites and add the frontend code.
How DOUBLECUP’s ClickFix Flow Recovers a PNG From Browser Cache
Campaigns use fake CAPTCHA prompts on login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce, with malicious code loaded through embedded iframes. When a victim visits a page, DOUBLECUP registers the session, forces the browser to download and cache a malicious PNG, then shows fake CAPTCHA instructions that convince the victim to paste and run a command that was auto-copied to the clipboard. The command locates the PNG by its exact file size in the browser cache and uses findstr or certutil to recover and execute the hidden first-stage payload.
The Fileless Second Stage and Key Derivation From the Victim’s IP
The first payload launches a fileless second-stage dropper that derives a decryption key from the victim’s public IPv4 address, verifies the final payload against a hardcoded SHA-256 hash, and executes it in memory. The key derivation ties the payload to the specific victim’s network, so the cached image and the pasted command are useless in isolation from that context.
CountLoader and DeviceManager Deliver Different Capabilities
CountLoader harvests system information, checks for crypto wallets, browser extensions, and Signal Desktop, persists through scheduled tasks, and can download and execute MSI packages, PowerShell modules, and DLLs. A macOS variant built for Intel and Apple Silicon installs a LaunchAgent and uses curl, sw_vers, system_profiler, and ioreg for system enumeration.
DeviceManager’s EtherHiding Command-and-Control Over Smart Contracts
DeviceManager is a modular Python-based RAT that uses blockchain smart contracts to determine its command-and-control IP address. Outside CIS countries it collects the machine GUID, disk ID, user SID, hostname, username, OS version, antivirus software, and domain information. It relies on EtherHiding to fetch C2 addresses from Ethereum and Polygon smart contracts and uses DNS A and TXT records for exfiltration and commands, an approach that makes the command infrastructure resilient to takedown.
Why Steganography in Browser Cache Changes the Detection Picture
Hiding the payload in browser-cached images evades file-based detection, since the malicious bytes sit inside a legitimate cached resource that security tools rarely inspect. The technique is not new — earlier ClickFix campaigns documented by Huntress hid LummaC2 and Rhadamanthys in PNG pixel data — but DOUBLECUP packages it into a service that any buyer can deploy. SOCRadar said it discovered the service through an open directory on an IP that also hosts the licensing panel.
SOCRadar published indicators and analysis, and the practical guidance for users is straightforward: do not run commands pasted from web pages presented as CAPTCHAs. The service model matters as much as the malware. By turning a technically involved delivery chain into a licensed product with managed infrastructure, DOUBLECUP lowers the barrier for operators who would not otherwise build steganographic loaders, and it shifts the economics of ClickFix campaigns in the same direction other loader services moved years ago.
The combination of browser-cache steganography and blockchain-derived command infrastructure is also a durability play: the operator keeps the payload out of the filesystem artifacts that endpoint scans inspect, and the C2 addresses live on Ethereum and Polygon contracts that are not subject to the same takedown processes as conventional domains. For defenders, the campaign shows how far the ClickFix technique has moved from its simpler origins, where a pasted command led directly to a malicious download.
