Cybersecurity researchers have uncovered a sophisticated new Loader-as-a-Service (LaaS) platform named DOUBLECUP that is using ClickFix attacks to infect Windows and macOS systems by hiding malware inside PNG images stored in victims’ browser caches. According to researchers from SOCRadar’s Threat Research Unit, the Russian-linked operation has been active since early June 2026, offering cybercriminals a subscription-based service that provides ready-made attack infrastructure, licensing, and a Go-based Windows toolkit for creating and managing large-scale malware campaigns.
The researchers said DOUBLECUP significantly lowers the technical barrier for cybercriminals by handling much of the infrastructure required for attacks. The platform hosts steganographic PNG images containing hidden malicious code, manages encryption keys, session endpoints, payload generation and rebuilding, while customers only need to create phishing websites and embed the provided code. This service-based model enables even less experienced threat actors to launch highly sophisticated malware campaigns with minimal technical expertise.
SOCRadar discovered the operation while investigating an exposed server directory that contained test files. The same IP address was later identified as hosting DOUBLECUP’s licensing panel. Investigators found that attackers use a Go-based application to configure campaign domains, URL paths, steganography techniques, payload locations and execution methods. The tool automatically generates browser-specific commands for Chrome, Microsoft Edge, Firefox, Brave and Opera, allowing campaigns to target users across multiple browsers.
The attack begins when victims visit fake login pages impersonating trusted online services such as NetSuite, Odoo, HubSpot or Salesforce. These websites display fraudulent CAPTCHA verification prompts while secretly forcing the victim’s browser to download and cache a malicious PNG image. Users are then instructed to paste and execute a command that has already been copied to their clipboard under the pretext of completing the CAPTCHA verification. Once executed, the command locates the cached PNG image and extracts the hidden malware embedded within it using Windows utilities such as findstr or certutil.
Researchers explained that the first-stage payload launches a fileless second-stage dropper, which retrieves the victim’s public IP address and uses it to generate a decryption key for the final encrypted payload. After verifying the payload using a hardcoded SHA-256 hash, the malware executes directly in system memory, making detection significantly more difficult for conventional security tools. The campaigns observed by SOCRadar primarily delivered two malware families: an updated version of CountLoader and a previously undocumented remote access trojan named DeviceManager.
CountLoader targets both Windows and macOS devices and is designed to collect extensive information about compromised systems. It searches for cryptocurrency wallet applications, browser extensions and Signal Desktop installations before establishing persistence using scheduled tasks on Windows or LaunchAgent services on macOS. The malware can also download and execute additional payloads, including MSI installers, PowerShell modules and DLL files, enabling attackers to expand their access and deploy further malicious tools.
The newly identified DeviceManager RAT is a modular Python-based remote access trojan that introduces an advanced command-and-control technique. Instead of relying on traditional servers, it uses Ethereum and Polygon blockchain smart contracts to determine the location of its command-and-control infrastructure through a method known as EtherHiding. This approach makes the infrastructure more resistant to disruption by security agencies. The malware collects detailed system information, including machine identifiers, operating system details, installed antivirus software, usernames and domain information, while using DNS records to receive commands, exfiltrate stolen data and download additional payloads.
Renowned cybercrime expert and former IPS officer Prof. Triveni Singh said ClickFix-based attacks represent a dangerous combination of social engineering and advanced malware delivery techniques. He advised users never to paste or execute commands in Command Prompt, PowerShell or Terminal simply because a website instructs them to do so during CAPTCHA or verification processes. He also urged organizations to strengthen browser security policies, deploy endpoint detection and response (EDR) solutions, implement application control, monitor DNS activity continuously and conduct regular cybersecurity awareness training. Keeping operating systems and browsers fully updated and accessing only trusted websites, he added, remain among the most effective safeguards against increasingly sophisticated malware campaigns.
