What Changed
SOCRadar says DOUBLECUP, a Russian loader-as-a-service running since early June 2026, uses ClickFix pages to hide malicious code in PNG images stored in the victim’s browser cache. It delivers CountLoader to Windows and macOS and a new Windows remote access trojan called DeviceManager.
Customers get a licence and a Go-based Windows tool for building campaigns. The service hosts the images, session endpoints and encryption keys and rebuilds payloads. Customers host the ClickFix sites themselves. SOCRadar found the service through an open directory at 213[.]139.77[.]109:9090, which later hosted its licensing panel.
How An Attack Runs
- Observed lures are fake CAPTCHA prompts on login pages imitating NetSuite, Odoo, HubSpot and Salesforce, loaded through embedded iframes.
- The page forces the browser to download and cache the PNG, then copies a browser-specific command to the clipboard and asks the visitor to paste and run it.
- The command finds the cached PNG by its exact file size and uses
findstrorcertutilto extract the first stage. - A fileless second stage uses the victim’s public IPv4 address to build the key for the final payload, checks it against a hard-coded SHA-256 hash and runs it in memory.
The Payloads
CountLoader collects system information, looks for cryptocurrency wallets and Signal Desktop, persists through scheduled tasks and can fetch MSI, PowerShell and DLL files. A macOS build installs a LaunchAgent. DeviceManager is a Python RAT that finds its C2 through Ethereum or Polygon smart contracts (EtherHiding) and uses DNS A and TXT records for commands and data theft. It collects host details in countries outside the CIS.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What To Verify First
- Alert when a browser or the Windows Run dialog launches
findstr,certutilor PowerShell against browser cache folders. - Tell users that a CAPTCHA asking them to paste a command is an attack, especially on a CRM login page.
- Watch for unusual DNS TXT lookups and smart-contract RPC traffic from workstations.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
