Security researchers have uncovered a new Russian Loader-as-a-Service (LaaS) platform named DOUBLECUP that is using ClickFix social engineering attacks to distribute malware. The service hides malicious payloads inside steganographic PNG images stored in a victim’s browser cache before delivering updated versions of CountLoader and a previously undocumented remote access trojan (RAT) called DeviceManager.
According to a report from SOCRadar, the malware campaign relies on multiple stages designed to evade detection. The first stage downloads a PNG image containing hidden malicious code into the browser cache. The embedded content is then extracted to execute a second-stage loader, which decrypts the final payload directly in memory.
Researchers found that the malware uses a custom SHA-256 Counter (CTR) stream cipher combined with an XOR operation, using the victim’s public IP address as the decryption key. This environmental keying technique ensures the payload can only be decrypted and executed on the intended target system.
DOUBLECUP Active Since June 2026
SOCRadar believes DOUBLECUP has been operating since early June 2026. Rather than carrying out attacks directly, the developers offer the platform as a service, providing cybercriminals with licenses and a Windows client for building campaigns.
Each customer receives a unique license containing information such as:
- License key
- Client IP address
- Active subscription period
- Version information
- Campaign labels
Operators can manage multiple malware campaigns from a single license.
The investigation began after researchers discovered an exposed directory at 213.139.77[.]109:9090, which contained testing files linked to DOUBLECUP’s licensing infrastructure.
ClickFix Delivers the Malware
Attackers using DOUBLECUP create fake websites that impersonate popular business applications, including:
- NetSuite
- Odoo
- HubSpot
- Salesforce
These fraudulent login pages display ClickFix prompts instructing victims to execute commands copied to their clipboard.
Behind the scenes, the malicious landing page performs several automated tasks:
- Retrieves configuration data from the attacker’s server.
- Downloads the steganographic PNG image into the browser cache.
- Registers a victim session.
- Detects the visitor’s browser and prepares browser-specific commands.
- Copies the appropriate ClickFix command to the victim’s clipboard.
- Waits for execution before redirecting the victim to another webpage.
The service supports major browsers, including Chrome, Edge, Firefox, Brave, and Opera.
Flexible Campaign Builder
Researchers discovered that DOUBLECUP includes a Go-based graphical client that enables operators to create and manage campaigns with minimal effort.
The client allows threat actors to configure:
- Target domains
- URL slugs
- Steganography methods
- Payload embedding techniques
- Archive formats
- Payload download URLs
- Attack actions
The platform automatically generates a configuration endpoint that supplies campaign settings and browser-specific payload instructions to infected systems.
Operators can also implement additional obfuscation or anti-analysis techniques, although these are optional and managed independently by each customer.
Telegram Bot Supports Operations
DOUBLECUP also integrates with a Telegram bot named @harrypoterlohBOT, which is used to:
- Monitor victim visits
- Deliver encryption keys
- Send commands
- Receive payload callbacks
SOCRadar linked the bot to a threat actor known as “johnnysilverhe,” who has also published a suspicious Visual Studio Code extension named Agent IDE on Microsoft’s official marketplace.
Multi-Stage Infection Process
Once the victim executes the ClickFix command, the malware searches the browser cache for the hidden PNG image and extracts embedded JavaScript, PowerShell, or VBScript code.
The extracted script launches the second-stage loader, which:
- Notifies the command-and-control (C2) server that the infection succeeded.
- Downloads an encrypted payload.
- Redirects the victim to a legitimate-looking webpage.
- Uses the victim’s public IPv4 address to derive the decryption key.
- Decrypts and executes the final malware payload entirely in memory.
Because the decryption key depends on the victim’s external IP address, the payload cannot be successfully decrypted on other systems, making malware analysis significantly more difficult.
CountLoader Receives New Capabilities
One of the primary payloads distributed through DOUBLECUP is an updated version of CountLoader, now available for both Windows and macOS.
The latest version introduces several new features, including:
- Scheduled task persistence
- Browser extension discovery
- Cryptocurrency wallet detection
- Signal Desktop detection
- Detailed system profiling
Researchers also identified unfinished functionality that scans browser shortcut (.LNK) files on Windows and rewrites them so that launching a browser also silently starts the malware in the background.
Although this feature currently appears inactive, it suggests ongoing development.
CountLoader’s primary purpose is to maintain communication with its command-and-control server, collect system information, and execute additional payloads.
Supported payload types include:
- Executables (EXE)
- DLL files
- MSI installers
- HTML Applications (HTA)
- Compressed archives
The malware can also remove persistence artifacts after completing operations, potentially reducing forensic evidence.
DeviceManager RAT Uses Blockchain-Based C2 Resolution
Researchers also discovered a previously undocumented Python-based remote access trojan named DeviceManager being delivered through the DOUBLECUP platform.
Unlike traditional malware, DeviceManager uses EtherHiding, a technique that stores command-and-control information inside Ethereum and Polygon smart contracts.
Instead of relying on fixed infrastructure, the malware dynamically retrieves active C2 server addresses from blockchain data before communicating over either HTTP or DNS tunneling.
This approach improves resilience by making infrastructure takedowns significantly more difficult.
Designed to Avoid Analysis
DeviceManager is distributed through a Delphi-based Inno Setup installer containing an encrypted Python environment.
After installation, the malware extracts its embedded Python runtime and launches the RAT.
It also checks the system’s language settings before execution.
If the system is configured with a language associated with Commonwealth of Independent States (CIS) countries, the malware immediately performs self-deletion by:
- Removing scheduled tasks
- Deleting its installation directory
- Terminating execution
This behavior is commonly used by malware operators seeking to avoid infecting systems located in their home region.
Extensive Remote Control Features
Once active, DeviceManager gathers detailed system information before contacting its command-and-control infrastructure.
Its capabilities include:
- Executing PowerShell scripts
- Running Python scripts
- Executing Windows command-line instructions
- Downloading additional malware
- Uploading collected data
- Reporting task completion
- Polling for new commands
Researchers observed the malware resolving one active C2 server at 91.92.240[.]100 using EtherHiding before communicating over DNS or HTTP.
Final Thoughts
SOCRadar says DOUBLECUP demonstrates how ClickFix campaigns continue to evolve into highly effective malware delivery platforms.
By combining steganography, environmental keying, clipboard-based social engineering, and blockchain-backed command-and-control resolution, the service provides cybercriminals with a stealthy and resilient infection framework.
The addition of updated CountLoader variants and the newly discovered DeviceManager RAT highlights the growing sophistication of malware-as-a-service operations. Organizations should educate users about ClickFix-style social engineering attacks, monitor unusual PowerShell activity, and deploy behavioral detection capable of identifying in-memory payload execution and browser cache abuse.
