DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

The DOUBLECUP loader-as-a-service operation exploits ClickFix social engineering lures to trick users into executing malicious commands, bypassing traditional perimeter defenses by abusing trusted browser cache directories to store steganographic PNG files containing encrypted payloads. The use of victim-specific encryption keyed on public IP addresses makes generic signature-based detection ineffective, while EtherHiding-based C2 resolution and DNS/HTTP tunneling allow the malware to evade standard network monitoring. This attack chain demonstrates how layered deception — combining human manipulation, living-off-the-land abuse, and novel payload obfuscation — can defeat organizations that rely solely on endpoint antivirus or static firewall rules. The emergence of a professionally managed, licensed 'loader-as-a-service' lowers the barrier for threat actors and signals a dangerous commoditization of advanced malware delivery infrastructure.