DOUBLECUP Loader-as-a-Service Uses ClickFix and Steganographic PNGs to Deliver CountLoader and DeviceManager RAT

A new Russian loader-as-a-service (LaaS) operation named DOUBLECUP is leveraging ClickFix social engineering lures and steganographic PNG images cached in victims’ browsers to deliver two distinct malware families: CountLoader and a previously undocumented remote access trojan called DeviceManager.

According to a technical report from SOCRadar, the attack chain begins when a victim visits a compromised or malicious website that mimics legitimate CRM login pages (NetSuite, Odoo, HubSpot, Salesforce). The site embeds an iframe that presents a ClickFix-style decoy, tricking the user into copying and executing a malicious command. This command searches the browser cache for a steganographic PNG image, extracts hidden JavaScript, VBScript, or PowerShell code, and launches the next stage.

The second-stage dropper decrypts the final payload in memory using a custom SHA-256 stream cipher in Counter (CTR) mode combined with bitwise XOR, using the victim’s public IP address as the cryptographic key. This environmental keying ensures the payload only executes on the intended machine, thwarting analysis in sandboxes.

DOUBLECUP operators use a Go-based Windows GUI client to manage campaigns, configure payloads, and issue commands via a Broadcast Pane. Each license includes a unique key and metadata, and multiple campaigns can be orchestrated per license. The service has been active since early June 2026.

One of the delivered payloads is CountLoader, which has Windows and macOS variants. It establishes persistence via scheduled tasks, audits browser extensions for cryptocurrency wallets, and profiles the host for Signal desktop. It also includes a function to rewrite browser shortcut targets to secretly launch the RAT, though this feature appears incomplete.

The second payload, DeviceManager, is a modular Python-based RAT that uses EtherHiding—resolving C2 servers via Ethereum/Polygon smart contracts—to communicate over HTTP or DNS tunneling. It is distributed as a Delphi-compiled Inno Setup installer and avoids execution on systems with Commonwealth of Independent States (CIS) language locales, deleting itself if detected.

DOUBLECUP highlights the growing sophistication of ClickFix campaigns, combining steganography, environmental keying, and blockchain-based C2 to evade defenses and maintain resilience.