DOUBLECUP ClickFix Service Hides Malware in Browser Cache Steganography

DOUBLECUP is a Russian loader-as-a-service (LaaS) platform that combines ClickFix social engineering attacks with browser cache steganography to deploy cross-platform malware. Operating since at least mid-2024, the service provides cybercriminals with a Go-based builder tool and fully managed backend infrastructure. By concealing payload data inside benign PNG images cached directly by victims’ web browsers, the DOUBLECUP ClickFix service bypasses network perimeter controls before tricking users into manually executing commands that unpack and launch malicious payloads.

Security researchers at SOCRadar discovered the platform after analyzing an open directory hosted at 213[.]139.77[.]109:9090, which exposed campaign test files and later served as the management and licensing panel for the service’s operators.

How the DOUBLECUP ClickFix Service Executes Attacks

ClickFix attacks manipulate victims into executing terminal commands on their own systems under the pretense of resolving a website error—such as passing a CAPTCHA check or fixing a browser rendering issue. DOUBLECUP automates the infrastructure required for these campaigns, supplying affiliates with steganographic image hosting, session management, dynamic encryption key generation, and automated payload rebuilding.

Affiliates are responsible for building and hosting the initial phishing pages, which frequently incorporate embedded iframe elements on sites designed to impersonate enterprise SaaS login portals for platforms like NetSuite, Odoo, HubSpot, and Salesforce.

When a victim visits one of these landing pages, the attack unfolds in distinct stages:

1. Session Registration & Cache Poisoning: DOUBLECUP registers the victim’s session, logs their public IP address, and forces the victim’s web browser to silently download and cache a steganographically altered PNG file.
2. Dynamic Command Selection: The backend checks the victim’s web browser—generating targeted payloads for Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, and Opera—and automatically copies a custom command string to the victim’s system clipboard.
3. Social Engineering Execution: The page displays instructions urging the user to open a terminal or run dialog (Win + R), paste the clipboard contents, and press Enter to complete a verification step.
4. Local Steganography Extraction: Upon execution, the pasted command scans the local browser cache directory for the exact file size of the preloaded PNG. It uses native system utilities like findstr or certutil on Windows to carve the concealed first-stage payload from the image pixels.
5. Memory Injection: The first stage launches a fileless dropper that queries the victim’s public IPv4 address to construct a decryption key for the final payload. Once decrypted and validated against a hardcoded SHA-256 hash, the payload is executed directly in memory.

Payload Analysis: CountLoader and DeviceManager RAT

DOUBLECUP delivers two primary malware families depending on the host OS architecture and campaign configuration:

CountLoader (Windows & macOS)

CountLoader conducts preliminary system reconnaissance, checks for installed cryptocurrency wallet applications and browser extensions, identifies whether Signal Desktop is running, and sets up persistence using scheduled tasks on Windows. CountLoader also functions as a secondary downloader capable of fetching and executing arbitrary MSI installers, PowerShell scripts, and DLL files.

The macOS variant of CountLoader includes universal binaries compiled for both Intel (x86_64) and Apple Silicon (arm64) architectures. It gains persistence by writing a custom LaunchAgent and uses native binaries like curl, sw_vers, system_profiler, and ioreg to collect telemetry and communicate with C2 servers.

DeviceManager RAT (Windows)

For targets located outside Commonwealth of Independent States (CIS) countries, DOUBLECUP deploys DeviceManager, a modular Python-based remote access trojan. DeviceManager collects host identifiers including the machine GUID, disk serial number, user SID, hostname, OS version, architecture, and installed antivirus software.

DeviceManager uses “EtherHiding,” a technique that queries smart contracts on the Ethereum or Polygon blockchains to resolve its current C2 server IP address. Because smart contract state on public blockchains cannot be altered or taken down by hosting providers, this mechanism shields the infrastructure from law enforcement sinkholing. For data exfiltration and command retrieval, DeviceManager uses custom DNS A and TXT record queries to bypass standard HTTP web application firewalls.

Technical Defenses and Mitigation Strategies

Defending against DOUBLECUP requires controlling command-line process execution, monitoring suspicious browser cache interactions, and inspecting non-standard egress communications:

• Restrict Script Execution from User Contexts: Enforce strict Attack Surface Reduction (ASR) rules and application control policies that block standard users from launching powershell.exe, cmd.exe, or terminal emulators directly via user-pasted scripts.
• Monitor System Utilities Accessing Browser Cache: Configure EDR detection rules for instances of certutil.exe or findstr.exe attempting to read files within browser cache directories (e.g., %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache).
• Detect DNS Exfiltration & Web3 Queries: Monitor corporate network gateways for anomalous high-frequency DNS TXT record lookups and unauthorized API requests to public Web3/RPC endpoints associated with Ethereum and Polygon smart contracts.