Researchers at SOCRadar’s Threat Research Unit have identified a new loader-as-a-service platform, dubbed DOUBLECUP, that has been active since early June 2026. The Russian-operated service combines ClickFix-style social engineering with steganographic PNG images cached in victims’ browsers to deliver malware to both Windows and macOS systems.

DOUBLECUP provides paying customers with licenses and a Go-based Windows tool for configuring campaigns, including the campaign domain, URL path, steganography method, embed type, execution action, and payload locations. The service manages the heavy infrastructure lifting, hosting the steganographic images, running session and signal endpoints, issuing encryption keys, and rebuilding payloads automatically. Customers are left to build and host the ClickFix websites and add any extra obfuscation.

SOCRadar discovered the operation while investigating an open directory containing test files, later linking the same IP address to the service’s licensing panel.

Attack Chain

Observed campaigns used fake CAPTCHA prompts on pages impersonating NetSuite, Odoo, HubSpot, and Salesforce login screens, with malicious code loaded via embedded iframes. Visiting one of these pages forces the browser to download and cache a malicious PNG image while DOUBLECUP registers the session and captures the victim’s public IP address.

The fake CAPTCHA instructions trick victims into pasting and running a clipboard-copied command. That command locates the cached PNG by its exact file size and uses findstr or certutil to extract and execute a hidden first-stage payload. This launches a fileless second-stage dropper that derives a decryption key from the victim’s public IPv4 address, verifies the decrypted payload against a hardcoded SHA-256 hash, and executes it entirely in memory.

Final Payloads

DOUBLECUP has been observed delivering two malware families:

  • CountLoader: an updated loader targeting both Windows and macOS. It harvests system information, checks for cryptocurrency wallets and browser extensions, detects Signal Desktop, establishes persistence via scheduled tasks (Windows) or a LaunchAgent (macOS), and can download and execute MSI packages, PowerShell modules, and DLLs. The macOS variant, compiled for both Intel and Apple Silicon, relies on built-in utilities like curl, sw_vers, system_profiler, and ioreg for C2 communication.
  • DeviceManager: a previously undocumented, modular Python-based Windows RAT that uses blockchain smart contracts and an EtherHiding technique to resolve its command-and-control server address. Outside Commonwealth of Independent States (CIS) countries, it collects machine GUID, disk identifier, user SID, hostname, username, OS version, architecture, installed antivirus, and domain information.

The use of browser-cached steganographic images adds a layer of evasion to the already effective ClickFix technique, since the malicious content never touches disk as a standalone file before execution, complicating detection for traditional endpoint tooling.