DOUBLECUP ClickFix Campaign Hides RAT Payloads in Browser Cache via Steganographic PNGs
Written by AI from the linked story. Not reviewed by an editor. How this works
The DOUBLECUP loader-as-a-service operation exploits ClickFix social engineering lures to trick users into executing malicious commands, bypassing traditional perimeter defenses by abusing trusted browser cache directories to store steganographic PNG files containing encrypted payloads. The use of victim-specific encryption keyed on public IP addresses makes generic signature-based detection ineffective, while EtherHiding-based C2 resolution and DNS/HTTP tunneling allow the malware to evade standard network monitoring. This attack chain demonstrates how layered deception — combining human manipulation, living-off-the-land abuse, and novel payload obfuscation — can defeat organizations that rely solely on endpoint antivirus or static firewall rules. The emergence of a professionally managed, licensed 'loader-as-a-service' lowers the barrier for threat actors and signals a dangerous commoditization of advanced malware delivery infrastructure.
Tactical Insight
Immediate actions
- Block or restrict clipboard-hijacking techniques by deploying browser policies that prevent unauthorized script execution triggered by ClickFix-style copy-paste lures.
- Implement DNS filtering and block known EtherHiding resolution patterns (e.g., blockchain-based DNS lookups) at the network perimeter.
- Scan browser cache directories on endpoints for anomalous or oversized PNG files using forensic or EDR tooling.
Detection measures
- Deploy behavioral detection rules in your EDR/SIEM to flag processes reading or decoding binary data from browser cache paths (e.g., `%AppData%\Local\...\Cache`).
- Monitor outbound DNS and HTTP traffic for tunneling indicators such as unusually long DNS query strings, high query frequency, or non-standard record type usage (TXT, NULL).
- Alert on steganography-related file access patterns by correlating image file reads with subsequent process injection or network connection events.
Long-term improvements
- Conduct regular security awareness training with specific scenarios covering ClickFix and copy-paste social engineering attacks to reduce user susceptibility.
- Enforce application whitelisting and script execution policies (e.g., via AppLocker or WDAC) to prevent unauthorized payloads from executing in user-writable directories.
- Implement network segmentation to isolate endpoints from direct internet egress, routing all outbound traffic through inspected, authenticated proxies.