[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flUiN1YrAl4pKJY3kxtuaz-QGwheeJEosFR5gC9WocsQ":3},{"article":4,"iocs":39,"watch_terms":52,"solutions":53,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"3354e37a-d896-42a9-9298-fea15bbd2e57","DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT","doublecup-uses-clickfix-and-cached-pngs-to-deliver-countloader-and-devicemanager-79321c","A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager. \"The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second","A Russian loader-as-a-service called DOUBLECUP has been actively delivering malware since June 2026 by embedding steganographic PNG images in victims' browser caches via ClickFix social engineering lures. The service distributes CountLoader and a previously unknown RAT called DeviceManager, with payloads encrypted using custom SHA-256 stream cipher in CTR mode keyed on the victim's public IP. The operation is managed through a Go-based GUI client with licensing, campaign orchestration, and command infrastructure relying on EtherHiding for C2 resolution and DNS\u002FHTTP tunneling.","DOUBLECUP loader-as-a-service uses ClickFix and cached PNGs to deliver CountLoader and DeviceManager RAT","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fdoublecup-uses-clickfix-and-cached-pngs.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh0MM7WIz9TI9RxDFZ-toTt_tLMlGIJGGyqnPZ5m68ft2_h16hOepWgOlGkRdx7KdUaRjz7GxanOYCp3167ZvcaWo1MV9ihUjZb6dHyX4Ss8SV6X4GGpobunHDfXs83HKppsCR-TT8quPfiNmH1Z-7EvWRZ4cdyHsHRsmlVshEJpDa76yUCjaWy0-xXaeeS\u002Fs1600\u002Fdouble.jpg","2026-08-04T09:03:23+00:00","2026-08-04T12:00:19.964317+00:00",9,[17,20,23,26],{"name":18,"type":19},"DOUBLECUP","campaign",{"name":21,"type":22},"johnnysilverhe","threat_actor",{"name":24,"type":25},"ClickFix","technology",{"name":27,"type":25},"EtherHiding","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[40,44,46,49],{"type":41,"value":42,"context":43},"ip","213.139.77.109","Open directory hosting DOUBLECUP license panel testing files",{"type":32,"value":18,"context":45},"Russian loader-as-a-service distributing CountLoader and DeviceManager RAT",{"type":32,"value":47,"context":48},"CountLoader","Malware payload delivered by DOUBLECUP with variants for Windows and macOS",{"type":32,"value":50,"context":51},"DeviceManager","Previously undocumented remote access trojan delivered via DOUBLECUP; uses EtherHiding for C2 resolution",[],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":85,"name":86,"problem":87,"products":88},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"slug":114,"name":115,"problem":116,"products":117},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":161},"doublecup-clickfix-campaign-hides-rat-payloads-in-browser-cache-via-steganographic-pngs","DOUBLECUP ClickFix Campaign Hides RAT Payloads in Browser Cache via Steganographic PNGs","The DOUBLECUP loader-as-a-service operation exploits ClickFix social engineering lures to trick users into executing malicious commands, bypassing traditional perimeter defenses by abusing trusted browser cache directories to store steganographic PNG files containing encrypted payloads. The use of victim-specific encryption keyed on public IP addresses makes generic signature-based detection ineffective, while EtherHiding-based C2 resolution and DNS\u002FHTTP tunneling allow the malware to evade standard network monitoring. This attack chain demonstrates how layered deception — combining human manipulation, living-off-the-land abuse, and novel payload obfuscation — can defeat organizations that rely solely on endpoint antivirus or static firewall rules. The emergence of a professionally managed, licensed 'loader-as-a-service' lowers the barrier for threat actors and signals a dangerous commoditization of advanced malware delivery infrastructure.",[148,149,150,151,152,153,154,155,156,157,158,159,160],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AT-2 – Security Awareness Training","NIST SP 800-53 AU-6 – Audit Record Review and Analysis","MITRE ATT&CK T1204 – User Execution","MITRE ATT&CK T1027.003 – Steganography","MITRE ATT&CK T1071.004 – DNS Application Layer Protocol","MITRE ATT&CK T1568 – Dynamic Resolution (EtherHiding)","NIST CSF DE.CM-1 – Network Continuous Monitoring","NIST CSF PR.AT-1 – Security Awareness for All Users",{}]