DOUBLECUP ClickFix Service Hides Malware in Cached Browser Images

In the rapidly evolving landscape of cyber threat delivery, the emergence of the DOUBLECUP ClickFix Service represents a paradigm shift in how threat actors bypass modern enterprise defenses. Uncovered in August 2026 by cybersecurity researchers from SOCRadar’s Threat Research Unit (STRU), DOUBLECUP is a sophisticated, Russian-origin Loader-as-a-Service (LaaS) platform that has been operational since early June 2026. The service specializes in orchestrating highly convincing ClickFix social engineering campaigns that deliver multi-stage payloads across both Windows and macOS enterprise environments. Rather than relying on traditional file downloads or unverified executables that routinely trigger endpoint protection alerts, the DOUBLECUP ClickFix Service subverts standard security boundaries by weaponizing local browser caches through image steganography, environmental IP-based keying, and user-assisted clipboard execution.

The operational philosophy behind the service exploits a fundamental tension in enterprise security: the human trust placed in routine web interactions versus the rigid security controls enforced on file downloads. By tricking enterprise users into copying and pasting malicious commands under the guise of solving a CAPTCHA or administrative authentication error, DOUBLECUP effectively turns legitimate system utilities into silent execution vectors. What distinguishes DOUBLECUP from legacy loaders is its turnkey commercial model, robust infrastructure management, and technical integration of decentralized command-and-control (C2) resolution via smart contracts. Below, we examine the inner workings, technical execution flow, delivered payloads, and strategic countermeasures necessary to defend enterprise networks against this evolving threat.

Deconstructing the DOUBLECUP ClickFix Service: Commercial Panel and Social Engineering Tactics

The commercial architecture supporting the DOUBLECUP ClickFix Service operates under a fully managed Loader-as-a-Service model. Developers of the service distribute custom client software alongside unique license keys to affiliate cybercriminals, enabling them to construct, deploy, and monitor multi-stage campaigns with minimal operational friction. Threat intelligence analysis of open administrative directories revealed a Go-based Windows Graphical User Interface (GUI) client that provides threat actors with granular control over their attack chains.

Commercial Panel Architecture and Payload Generation

The DOUBLECUP operator panel incorporates key operational modules that streamline attack orchestration across diverse victim environments:

• License and Access Control: Each operator license key embeds critical metadata, including client egress IP addresses, active service duration, campaign labels, and software versioning. This licensing structure allows core developers to enforce access limits while enabling affiliates to manage multiple parallel campaigns.
• Broadcast Pane: A real-time command-and-control interface that permits operators to update client configurations, push software patches, and issue dynamic operational commands directly to active deployments.
• Payload Builder Pane: A dedicated configuration hub where operators define campaign parameters, including target domain structures, custom URL slugs, archive formats, steganographic encoding methods, embed mechanisms, and payload staging URLs.

Targeting Enterprise SaaS Portals via ClickFix Lures

To maximize infection success among corporate workers, DOUBLECUP campaigns deploy meticulously crafted landing pages that impersonate widely adopted enterprise Software-as-a-Service (SaaS) platforms. Prominent targets observed in active campaigns include:

• NetSuite: Mimicking enterprise resource planning (ERP) login screens and session expiration prompts.
• Salesforce: Displaying fake single sign-on (SSO) authentication timeouts and security check alerts.
• Odoo: Threatening workflow interruptions through fake database sync errors.
• HubSpot: Presenting fake identity verification and CAPTCHA challenges to marketing and sales personnel.

When an unsuspecting target visits one of these compromised or rogue landing pages, the site displays a fake CAPTCHA challenge or systemic error notification. The prompt instructs the victim to “resolve” the issue by clicking a button that silently copies an obfuscated command string to the user’s system clipboard. The interface then guides the user to open a native system terminal—such as Windows PowerShell, Command Prompt, or macOS Terminal—and execute the clipboard content. Because the execution originates from a manual user action rather than a browser-initiated file download, perimeter web filters and browser security mechanisms like Google Safe Browsing are completely bypassed.

Technical Execution Chain: Steganography and Environmental Keying

Once the victim executes the clipboard-pasted script, the DOUBLECUP ClickFix Service initiates a multi-stage infection sequence designed to neutralize static analysis, automated sandbox environments, and disk-level antivirus detection.

Stage 1: Steganographic Image Delivery into Local Browser Cache

The initial JavaScript payload embedded in the ClickFix landing page triggers the browser to download a seemingly benign Portable Network Graphics (PNG) image. Rather than writing this file directly to disk as a binary executable, the browser processes and stores the PNG image inside its local browser cache directory (e.g., Chrome, Edge, or Safari cache storage). Because security controls treat cached media files as routine web collateral, endpoint antivirus solutions and disk scanners routinely bypass the cached image without issuing security alerts.

Stage 2: IP-Based Environmental Keying and Cryptographic Decryption

The second-stage script, executed via the user’s terminal, accesses the cached PNG image, reads its raw pixel data, and extracts the steganographically hidden payload. To prevent security research teams and automated analysis sandboxes from inspecting the underlying malware, DOUBLECUP implements a stringent environmental keying mechanism:

• Custom SHA-256 CTR Stream Cipher: The hidden secondary payload is encrypted using a custom SHA-256 stream cipher operating in Counter (CTR) mode coupled with bitwise XOR operations.
• Victim Public IP as Cryptographic Key: The decryption key is dynamically derived from the target system’s public IP address.
• Silent Decryption Failure: If the payload is retrieved within an automated malware sandbox, threat intelligence crawler, or security lab featuring an IP address different from the target system that initiated the session, the decryption algorithm yields garbage data and fails silently without executing.

Cross-Platform Payload Analysis: CountLoader and DeviceManager RAT

Upon successful decryption in system memory, DOUBLECUP delivers tailored final payloads depending on the underlying operating system and operational objectives of the campaign.

CountLoader (v4.5p): Advanced Fileless Evasion

CountLoader v4.5p serves as a primary fileless delivery vehicle for both Windows and macOS operating systems. Its updated architecture emphasizes stealthy process execution and binary masquerading:

• Windows Execution Path: On Windows endpoints, CountLoader leverages native administrative interpreters (`powershell.exe`, `mshta.exe`). To bypass behavioral detection rules, CountLoader duplicates legitimate system binaries into temporary directories, renames them, and patches their Portable Executable (PE) headers—specifically modifying fields like OriginalFilename and InternalName—to masquerade as trusted software such as Microsoft OneDrive.
• macOS Execution Path: On macOS endpoints, CountLoader deploys a native Mach-O binary script that executes filelessly in memory, evading Apple’s Gatekeeper and background system checks.

DeviceManager RAT: Smart Contracts and DNS Tunneling

For Windows targets requiring sustained remote access, DOUBLECUP deploys DeviceManager RAT, a previously undocumented Remote Access Trojan engineered for persistence and infrastructure resilience:

• EtherHiding for C2 Infrastructure: DeviceManager RAT utilizes EtherHiding techniques, querying smart contracts hosted on the Ethereum and Polygon blockchains to retrieve dynamic Command-and-Control (C2) configuration data. By hosting C2 lookup records inside decentralized blockchain transactions, the threat actors ensure that infrastructure cannot be taken down via standard domain seizures or IP blocking.
• DNS Tunneling and Subdomain Spoofing: To maintain ongoing communications with its C2 servers without drawing network security scrutiny, DeviceManager RAT uses DNS tunneling protocols. These outbound DNS queries are crafted to impersonate legitimate Microsoft subdomains, blending seamlessly with normal corporate network telemetry.

Defensive Strategies and Mitigation Recommendations

Neutralizing threats associated with the DOUBLECUP ClickFix Service requires a defense-in-depth approach spanning behavioral endpoint monitoring, network egress filtering, and administrative script restrictions.

Endpoint Monitoring and Behavioral Rules

Security teams should immediately deploy Endpoint Detection and Response (EDR) behavioral rules designed to detect abnormal interaction between command shells and browser storage:

• Detect administrative shells (`cmd.exe`, `powershell.exe`, `mshta.exe`, `terminal`) accessing local browser cache directories (e.g., `%LocalAppData%\Google\Chrome\User Data\Default\Cache`, `~/Library/Caches`).
• Flag instances where system binaries like PowerShell or MSHTA exhibit modified PE headers or non-standard file paths disguised as legitimate applications.
• Restrict clipboard-to-terminal script execution by enforcing strict user access controls and terminal security policies.

Scripting Rules and Enterprise Execution Policies

Organizations must harden PowerShell and command line execution policies across all user endpoints:

• Enforce PowerShell Constrained Language Mode (CLM) and mandate Antimalware Scan Interface (AMSI) integration for all terminal environments.
• Enable comprehensive PowerShell Script Block Logging (Event ID 4104) to log and inspect obfuscated script execution in real time.
• Block unverified VBScript, Batch, and PowerShell execution initiated by non-administrative user contexts.

Network Controls and Decentralized Infrastructure Monitoring

At the network layer, organizations must monitor for decentralized infrastructure lookups and anomalous covert channels:

• Implement continuous DNS telemetry monitoring to detect DNS tunneling patterns, specifically focusing on high-frequency TXT or CNAME queries to pseudo-Microsoft subdomains.
• Inspect and restrict outbound traffic connecting to public Ethereum and Polygon RPC nodes from non-developer enterprise endpoints.
• Maintain active threat hunting protocols for newly registered domains hosting fake SaaS login portals and CAPTCHA challenges.

Conclusion

The DOUBLECUP ClickFix Service illustrates how modern cybercrime syndicates continue to blend social engineering ingenuity with evasive technical execution. By shifting payload delivery into local browser image caches, locking execution behind public IP keying, and anchoring command-and-control infrastructure within immutable smart contracts, DOUBLECUP presents a formidable challenge to conventional security architectures. To mitigate this threat, enterprise security programs must look beyond traditional file download inspection, deploying behavioral detection capabilities that cover clipboard interactions, browser cache access, and decentralized network communications.