DOUBLECUP Loader Uses ClickFix & Steganographic PNGs to Deploy RATs

A Russian-language loader-as-a-service (LaaS) tracked as DOUBLECUP has been weaponizing ClickFix social engineering lures since at least early June 2026 to stage steganographic PNG images in victims' browser caches, ultimately delivering CountLoader and a previously undocumented remote access trojan dubbed DeviceManager. According to researchers at SOCRadar, the first stage drops a PNG image containing hidden content into the browser's cache, retrieves the embedded data, and executes a second stage that decrypts the final payload in memory using a custom SHA-256 stream cipher in Counter (CTR) mode with bitwise XOR, using the victim's public IP address as the cryptographic key. Security teams can audit their environments against suspicious outgoing connections using an open port scanner to identify indicators of compromise.

DOUBLECUP operates on a licensed model, with each client receiving a unique license key embedded with metadata including the operator's IP address, active days, label, and version. A Go-based Windows GUI client provides operators with a Payload Builder Pane to configure ClickFix landing pages by setting the domain, slug, steganography method, embed type, archive format, action, and payload URLs. The configuration is served from an endpoint at https://{domain}/{slug}/api/config, returning steganographic image URLs, session endpoints, and browser-specific commands tailored for Chrome, Edge, Firefox, Brave, and Opera. The attack chain fetches this config, prefetches the steganographic image, registers a session, evaluates the User-Agent string to select the appropriate browser payload, and then displays ClickFix instructions that copy a matching command to the victim's clipboard before initiating a polling mechanism for final redirect.

Delivered payloads include CountLoader variants for both Windows and macOS, plus DeviceManager, which leverages EtherHiding techniques to resolve its command-and-control infrastructure and communicate over HTTP or DNS tunneling. Operators can layer in additional obfuscation or anti-analysis mechanisms at their discretion. SOCRadar's investigation originated from an exposed open directory at 213.139.77.109:9090, which leaked testing files later tied to DOUBLECUP's license panel. Given the use of IP-based cryptographic keys and DNS tunneling for C2, defenders should run a DNS leak test to ensure their systems aren't inadvertently leaking resolver information that could aid threat actor reconnaissance, and verify the integrity of any ClickFix-adjacent infrastructure with a targeted WHOIS lookup to flag suspicious recent registrations associated with active campaigns.