DOUBLECUP ClickFix Service Hides Malware in Browser Cache

A new Russian malware service called DOUBLECUP ClickFix hides malicious code inside PNG images stored in a victim’s browser cache.

The service uses fake CAPTCHA prompts to trick victims into running commands copied to their clipboard. Those commands recover the hidden code and launch malware on Windows and macOS devices.

SOCRadar’s Threat Research Unit says DOUBLECUP has operated since early June 2026. Its operators sell licences and provide a Go-based Windows tool that helps customers create malicious campaigns.

DOUBLECUP provides campaign infrastructure

DOUBLECUP works as a loader-as-a-service platform. It handles much of the infrastructure that operators need to run ClickFix attacks.

The service hosts steganographic PNG files, manages session and signal endpoints, supplies encryption keys, and automatically rebuilds payloads.

Customers must create and host the websites that show the fake ClickFix prompts. They also add the generated frontend code and can apply their own obfuscation or anti-analysis techniques.

SOCRadar found DOUBLECUP while investigating an open directory on a server that contained test files. Researchers later identified the same IP address as the host of the service’s licensing panel.

Using the Go-based tool, customers can configure campaign domains, URL paths, payload locations, execution actions, and image-hiding methods. The tool then generates code tailored for Chrome, Edge, Firefox, Brave, and Opera.

Fake CAPTCHA pages cache malicious images

DOUBLECUP ClickFix campaigns use fake CAPTCHA prompts on login pages that impersonate services such as NetSuite, Odoo, HubSpot, and Salesforce.

The malicious code loads through embedded iframes. When a visitor opens the page, the site registers a session, checks the visitor’s public IP address, and downloads a malicious PNG image into the browser cache.

The page then displays instructions designed to convince the visitor to paste and run a command.

That command searches the browser cache for a PNG file with an exact size. It then uses findstr or certutil to recover and execute the first-stage payload hidden inside the image.

The first stage launches a fileless dropper. It retrieves the victim’s public IPv4 address and uses it to generate a decryption key for the final encrypted payload.

After checking the decrypted file against a hardcoded SHA-256 hash, the dropper runs it in memory.

CountLoader and DeviceManager RAT delivered

SOCRadar identified two malware families delivered through DOUBLECUP: an updated CountLoader and a previously undocumented Windows remote access trojan called DeviceManager.

CountLoader targets Windows and macOS devices. It gathers information about infected systems, checks for crypto wallets and browser extensions, and looks for Signal Desktop.

It can establish persistence through scheduled tasks. It can also download and run files, including MSI packages, PowerShell modules, and DLLs.

The macOS version supports Intel and Apple Silicon systems. It creates a LaunchAgent for persistence and uses built-in utilities to communicate with attacker-controlled servers.

DeviceManager is a modular Python-based RAT for Windows. It uses EtherHiding to obtain its command-and-control address from an Ethereum or Polygon smart contract.

Outside Commonwealth of Independent States countries, the RAT gathers extensive system information. It can also use DNS A and TXT records to send stolen data, retrieve commands, download payloads, and return command output.

The DOUBLECUP ClickFix service shows how attackers continue to adapt social engineering attacks. Users should never paste commands into a terminal or Run dialog because a website instructs them to do so.