A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims’ browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager.
“The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage,” SOCRadar said in a technical report. “This second stage decrypts the final payload in memory via a custom SHA-256 stream cipher in Counter (CTR) mode along with bitwise XOR using the victim’s public IP address as the cryptographic key.”
Payloads delivered via the loader service include CountLoader, with variants for both Windows and macOS, and DeviceManager, which utilizes EtherHiding to resolve its command-and-control (C2) infrastructure and communicate with the server over HTTP or DNS tunneling.
The service is assessed to be active since early June 2026, with the core developers providing operators with licenses and a client agent to help create campaigns and load payloads by embedding the required code in their ClickFix landing pages. Each license comes with a unique key and contains metadata including the client’s IP address, active days, label, and version. Multiple campaigns can be orchestrated per license.
SOCRadar said its investigation sprang forth from an open directory at “213.139.77[.]109:9090” that left several testing files that were later identified as part of the DOUBLECUP license panel.
The Go-based Windows GUI client also offers operators the ability to update configurations, update the software, and issue commands directly via a Broadcast Pane, while a Payload Builder Pane allows threat actors to set up the command that’s triggered via a ClickFix decoy. This involves setting up the domain, slug, steganography method, embed type, archive format, action, and payload URLs.
“This generates a configuration endpoint at https://{domain}/{slug}/api/config,” SOCRadar said. “A GET request to this endpoint returns DOUBLECUP’s configuration data, which includes the steganographic image URL hosted on the target domain, image size, the session endpoint, and browser-specific commands tailored for Chrome, Edge, Firefox, Brave, and Opera.”
The attack also requires operators to inject necessary frontend code onto their ClickFix site to trigger the malicious code. This involves the following steps –
- Fetching the /api/config endpoint, prefetching the steganographic image, registering a session, and evaluating the browser User-Agent string to select the appropriate browser payload
- Displaying ClickFix instructions, copying the browser-matched command to the victim’s clipboard, and initiating a polling mechanism to execute the final redirect
Operators can opt to incorporate additional obfuscation or anti-analysis mechanisms into their payloads, but these extra steps remain solely their responsibility. Meanwhile, a Telegram bot (@harrypoterlohBOT) is used to track client visits, send commands, deliver keys, and receive payload callbacks via a designated DOUBLECUP URL.
Interestingly, the bot is managed by a threat actor named “johnnysilverhe,” who has also published a suspicious Microsoft Visual Studio Code (VS Code) extension named Agent IDE in the official marketplace.
Campaigns using DOUBLECUP have leveraged a cluster of bogus sites impersonating CRM login pages, including NetSuite, Odoo, HubSpot, and Salesforce, to deliver the loader via embedded iframe elements, which then pave the way for ClickFix commands that, upon execution, search the browser cache for the PNG image and extract from it malicious JavaScript, VBScript, or PowerShell to launch the next-stage component.
At this point, the C2 server is notified of a successful infection. The second-stage then acts as a dropper to deploy an encrypted payload and then redirect the victim to a destination page. The payload employs environmental keying as an anti-analysis technique to ensure that it’s unpacked only on the victim’s machine.
This is accomplished by passing the victim machine’s public IPv4 address as a seed into a key derivation function to generate the cryptographic key necessary to decode the payload. The decryption process fails on any machine other than the intended target, as it would yield the wrong key.
The attack chain ends with the stager reconstructing the final payload and executing it. One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks, audit installed browser extensions for cryptocurrency wallets, and profile the host to check if Signal’s desktop app is installed.
“CountLoader also includes a function that scans the desktop and start menu for shortcuts (.LNK files) belonging to popular web browsers,” SOCRadar explained. “It rewrites the target of these shortcuts so that when the user double-clicks their browser shortcut, it secretly launches the intended browser and the RAT in the background.”
“However, this function is never invoked, indicating it may be an incomplete feature or dead code under development.”
The primary objective of CountLoader is to connect to a C2 server, gather system metadata and exfiltrate it, and await further tasks from the operator, allowing it to run secondary executables, DLLs, MSI, or HTML Application (HTA) files, download a compressed archive, extract its contents, and run the main binary present within the extracted folder, and clean up persistence mechanisms likely to erase forensic evidence.
There exists an equivalent macOS version of CountLoader that features the same functionality as its Windows PowerShell variant, but adapts its persistence and reconnaissance methods for Apple’s desktop operating system.
The second payload delivered via the DOUBLECUP infrastructure is a modular Python-based RAT codenamed DeviceManager that utilizes the blockchain as a dead drop resolver to fetch the C2 server details, a technique known as EtherHiding. Specifically, the trojan dynamically resolves its active C2 nodes via Ethereum/Polygon smart contracts before establishing C2 communications.
DeviceManager is distributed as a Delphi-compiled Inno Setup installer that embeds the encrypted payload. Once launched, it extracts a full embedded Python environment to spawn the Python malware. At the same time, it deliberately avoids executing on machines that resolve to Commonwealth of Independent States (CIS) language locales.
“If a target CIS language is detected, DeviceManager executes a self-deletion routine: it removes its scheduled task, deletes its installation directory via cmd.exe, and terminates process execution,” the cybersecurity company said.
The malware then proceeds to collect extensive device information, use Etherhiding to extract the C2 server (“91.92.240[.]100”), and communicate with it using DNS or HTTP to exfiltrate system data, poll for tasks, download payloads, send command execution results, and report task status. DeviceManager is equipped to run PowerShell and Python scripts, as well as pipe operator-issued commands into “cmd.exe.”
“DOUBLECUP highlights the expanding reach of ClickFix campaigns, providing threat actors with a low-friction, highly reliable payload delivery pipeline,” SOCRadar said. “Built with evasion at its core, DOUBLECUP leverages steganography and environmental keying to bypass defenses.”
“CountLoader evades process monitoring by copying and header-patching legitimate Windows binaries, while DeviceManager utilizes smart contracts on the Ethereum/Polygon blockchains for resilient C2 infrastructure resolution.”
