The Evolving Threat Landscape
A new Russian loader-as-a-service named DOUBLECUP has emerged, representing a sophisticated evolution in cybercriminal infrastructure. Operating since early June 2026, this service combines social engineering with technical steganography to deliver malicious payloads to unsuspecting victims. According to SOCRadar's Threat Research Unit, DOUBLECUP provides customers with licenses and a Go-based Windows tool for creating malicious campaigns.
The service handles much of the complex infrastructure required to conduct these attacks, including hosting steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads. This allows operators to focus on deploying their campaigns while DOUBLECUP manages the technical underpinnings.
How ClickFix Attacks Work
The attack mechanism relies on a technique known as ClickFix, which tricks users into running system commands that appear legitimate. When a victim visits a compromised website, the page forces their browser to download and cache a malicious PNG image. The image contains hidden payload data embedded within its pixel structure—a technique called steganography.
Here's what happens next:
- Session Registration: DOUBLECUP registers the visitor's session and determines their public IP address
- Image Delivery: A fake CAPTCHA prompt displays on login pages impersonating legitimate services like NetSuite, Odoo, HubSpot, or Salesforce
- Command Execution: The page copies a command to the clipboard that appears to be part of the CAPTCHA verification process
- Payload Extraction: Once executed, the command searches the browser cache for the PNG file and uses
findstrorcertutilcommands to recover and execute the hidden payload inside the image
This fileless approach allows attackers to bypass traditional security controls that might not monitor browser cache activity or clipboard operations.
The Malware Payloads
CountLoader: Updated and More Dangerous
CountLoader, an updated version of an existing malware family, targets both Windows and macOS devices. On Windows systems, it establishes persistence through scheduled tasks and can download additional malicious files including MSI packages, PowerShell modules, and DLLs. It harvests comprehensive system information, checks for cryptocurrency wallet applications, enumerates browser extensions, and specifically looks for Signal Desktop installations.
The macOS variant demonstrates the attackers' cross-platform capabilities. Compiled for both Intel and Apple Silicon devices, it installs a LaunchAgent for persistence and uses built-in utilities like curl, sw_vers, system_profiler, and ioreg to communicate with attacker-controlled servers. This version shows how malware authors adapt their tools to target modern hardware architectures.
DeviceManager RAT: A New Discovery
Perhaps more concerning is DeviceManager, a previously undocumented remote access trojan that DOUBLECUP delivers. This modular Python-based Windows RAT uses an advanced technique called EtherHiding to retrieve its command-and-control server address from Ethereum or Polygon smart contracts. This blockchain-based approach makes the malware significantly more resistant to disruption attempts—taking down one server doesn't affect the others referenced in the smart contract.
DeviceManager collects extensive system information including machine GUID, disk identifier, user SID, hostname, username, operating system version, architecture, installed antivirus software, and domain information (in non-CIS regions). It uses DNS A and TXT records to steal data, retrieve commands, download payloads, and send command output back to attackers.
The Service Infrastructure
SOCRadar discovered DOUBLECUP while investigating an open directory at 213[.]139.77[.]109:9090 containing test files. This IP address was later identified as hosting the service's licensing panel. To launch an attack, customers use the Go-based Windows application to configure:
- Campaign domain and URL path
- Steganography method and embed type
- Execution action and payload locations
The service generates API configuration endpoints that return the steganographic image URL, file size, session endpoint, and browser-specific commands for Chrome, Edge, Firefox, Brave, and Opera.
Why This Matters
DOUBLECUP represents a significant evolution in the loader-as-a-service model. By combining social engineering (fake CAPTCHAs) with technical obfuscation (steganography), attackers can bypass multiple layers of security controls. The use of blockchain for command-and-control adds another dimension of resilience that traditional takedown efforts cannot easily address.
The fact that this service has been operating since June 2026 and already delivers both updated and new malware families suggests a mature, well-established criminal infrastructure. Security teams should monitor for unusual PNG downloads from login pages, watch for ClickFix-style prompt commands, and ensure EDR solutions can detect the findstr/certutil payload extraction techniques.
This is not an isolated incident—Huntress has previously documented campaigns that concealed LummaC2 and Rhadamanthys payloads within PNG pixel data. DOUBLECUP demonstrates how these techniques continue to evolve and become more sophisticated.
Defensive Recommendations
- Monitor for unusual PNG downloads from login pages impersonating legitimate services
- Implement detection rules for ClickFix-style prompt commands
- Ensure EDR can detect fileless payload extraction using findstr/certutil
- Watch for network communications related to DeviceManager's blockchain-based C2
- Test breach and attack simulation scenarios regularly to verify detection coverage
The persistence of such threats underscores the need for continuous vigilance. Attackers are constantly innovating, and what worked last year may not work today. Security teams must stay ahead by understanding these evolving techniques and adapting their defenses accordingly.
