A Russian loader‑as‑a‑service named DOUBLECUP uses ClickFix attacks to conceal malicious code inside PNG images cached by browsers. The technique delivers CountLoader and a new DeviceManager RAT to Windows and macOS systems.

Key Takeaways

  • DOUBLECUP uses steganographic PNGs to deliver CountLoader and DeviceManager.
  • The attack exploits fake CAPTCHA prompts on popular SaaS login pages.
  • Victims' browsers cache the malicious image, enabling file‑less execution.

How DOUBLECUP Operates

According to SOCRadar’s Threat Research Unit, DOUBLECUP has been running as a loader‑as‑a‑service since June 2026. Customers configure campaigns with a Go‑based Windows tool, specifying domain, URL path, steganography method, embed type, execution action, and payload locations. The tool automatically generates an API endpoint that returns a steganographic image URL tailored for Chrome, Edge, Firefox, Brave, and Opera.

Fake CAPTCHAs and Cache‑Based Exploits

Attackers impersonate login pages of NetSuite, Odoo, HubSpot, and Salesforce, presenting bogus CAPTCHA prompts. When a visitor opens such a page, DOUBLECUP forces the browser to download a malicious PNG and store it in the cache, while also copying a command to the clipboard. The displayed instructions urge users to paste and run the copied command, which then searches the cache for the image by exact file size and extracts the hidden payload using findstr or certutil.

First‑Stage and Second‑Stage Payloads

The extracted first‑stage payload launches a file‑less dropper that fetches the victim’s public IPv4 address to generate a decryption key. After verifying the decrypted payload against a hard‑coded SHA‑256 hash, it executes in memory, delivering two families: an updated CountLoader for Windows/macOS and a new DeviceManager RAT for Windows.

Historical Background

Image steganography for malware dates back to 2017, when researchers first observed code hidden in PNG pixel data. Huntress previously documented ClickFix campaigns that concealed LummaC2 and Rhadamanthys payloads using the same technique.

Why This Matters

BozokMedia analysis shows that file‑less, cache‑based attacks bypass many traditional antivirus solutions, forcing enterprise security teams to adopt new detection strategies focused on network‑level anomalies.

"Steganography‑based cache attacks are likely to evolve, making robust network monitoring a critical defense layer."
Did You Know?: The first known image‑steganography malware appeared in 2017, but DOUBLECUP has turned it into a scalable service model.

Frequently Asked Questions

  • Is this attack limited to Windows? No, CountLoader also targets macOS, while DeviceManager is Windows‑only.
  • How can users protect themselves? Avoid interacting with unknown CAPTCHA prompts, regularly clear browser cache, and enable anti‑phishing extensions.