Full Report
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. [...]
Analysis Summary
# Tool/Technique: DOUBLECUP ClickFix Service
## Overview
DOUBLECUP is a Russian "loader-as-a-service" (LaaS) that facilitates ClickFix attacks. It employs steganography to hide malicious payloads within PNG images that are cached by a victim's browser. The service provides a Go-based toolkit for operators to manage infrastructure, including steganographic image hosting and payload rebuilding.
## Technical Details
- **Type**: Loader-as-a-Service (LaaS) / Malware Delivery Platform
- **Platform**: Windows, macOS
- **Capabilities**: Steganography-based payload delivery, browser cache exploitation, automated payload rebuilding, cross-browser command generation.
- **First Seen**: June 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1204.001 - User Execution: Malicious Link] (ClickFix prompts)
- **[TA0002 - Execution]**
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1027.003 - Obfuscation: Steganography]
- [T1027.002 - Software Packing]
- [T1140 - Deception/Decoy: De-obfuscate/Decode Files or Information] (Using `certutil` or `findstr`)
## Functionality
### Core Capabilities
- **Infrastructure Management**: Handles session endpoints, encryption keys, and hosting for malicious PNGs.
- **ClickFix Integration**: Generates frontend code for fake CAPTCHAs and login pages (impersonating NetSuite, HubSpot, etc.).
- **Steganographic Delivery**: Embeds malicious code in PNG files that are pre-cached by the browser to avoid network-based detection of executable transfers.
- **Cross-Platform Delivery**: Capable of deploying payloads to both Windows and macOS systems.
### Advanced Features
- **Browser Cache Harvesting**: The attack command searches the local browser cache for the specific PNG file size to extract the payload.
- **EtherHiding**: Uses Ethereum or Polygon blockchain smart contracts to dynamically retrieve Command and Control (C2) IP addresses.
- **Fileless Execution**: Employs a second-stage dropper that executes the final payload (CountLoader or DeviceManager) directly in memory.
## Indicators of Compromise
- **File Hashes**: (Specific hashes not provided in text; analysis suggests monitoring for high-entropy PNGs).
- **Network Indicators**:
- `213[.]139.77[.]109:9090` (Licensing panel/Open directory)
- Blockchain smart contracts (Ethereum/Polygon)
- **Behavioral Indicators**:
- Use of `findstr` or `certutil` targeting files within browser cache directories.
- Unexpected `PowerShell` or `CMD` execution immediately following browser interaction.
- LaunchAgent creation on macOS (`~/Library/LaunchAgents`).
## Associated Threat Actors
- **Russian-speaking operators** (identified as a Russian loader-as-a-service).
## Detection Methods
- **Behavioral Detection**: Monitor for web pages that trigger "copy to clipboard" actions followed by instructions for users to paste commands into a terminal (PowerShell/Run prompt).
- **Endpoint Monitoring**: Audit the use of `findstr.exe` and `certutil.exe` when the source file is located in browser cache paths (e.g., `%LocalAppData%\Google\Chrome\User Data\Default\Cache`).
- **Network Security**: Implement DNS filtering to block known malicious domains and monitor for unusual TXT record queries used for C2 communication.
## Mitigation Strategies
- **User Education**: Train employees to never paste and execute commands from a website, especially those claiming to be "fixes" or CAPTCHAs.
- **Attack Surface Reduction**: Use Group Policy to restrict the execution of administrative tools like `certutil.exe` or `powershell.exe` for standard users where not required.
- **Browser Security**: Use web filtering solutions to block known ClickFix infrastructure and newly registered domains.
## Related Tools/Techniques
- **CountLoader**: Information stealer and persistent loader.
- **DeviceManager**: A modular Python-based Windows RAT.
- **ClickFix**: The broader social engineering technique.
- **EtherHiding**: The technique of hiding C2 information in blockchain transactions.