A threat group operating a Russian loader-as-a-service called DOUBLECUP has been running ClickFix campaigns since at least June 2026, using a novel twist on an already-established attack technique: the malicious payload is hidden inside PNG images that a victim’s browser automatically caches, bypassing many traditional file-based detections.
ClickFix attacks typically trick users into pasting a PowerShell or terminal command into their own machine — often disguised as a “browser verification” step or a captcha. DOUBLECUP adds a steganographic layer: the operators embed the malware code directly into benign-looking PNG images hosted on their infrastructure, which the victim’s browser silently downloads and caches. The embedded code then executes and stages two payloads: CountLoader, a cross-platform downloader that runs on both Windows and macOS, and DeviceManager, a new remote access trojan targeting Windows. SOCRadar’s Threat Research Unit, which discovered the service after finding an open directory on a DOUBLECUP server, says the group sells licenses and provides a Go-based Windows application for generating campaigns, handling hosting, encryption keys, session management, and automatic payload rebuilds. Customers provide the lure websites and ClickFix prompts.
The technique is designed to minimize forensic footprint: because the malicious data arrives inside a cached image rather than a standalone executable, it can evade tools that watch for direct file downloads of suspicious types. DOUBLECUP’s use of a commercial model — where individual operators pay for the infrastructure — mirrors the broader ransomware-as-a-service playbook and lowers the technical bar for conducting these attacks.