[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnO-ZcEZFbDXvbyatvzbHHQFyg_aS3_RGxRh8adpQDF8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":59},"f579c3e2-05c9-44fc-861d-80f6edbecfa5","doublecup-clickfix-campaign-hides-rat-payloads-in-browser-cache-via-steganographic-pngs","3354e37a-d896-42a9-9298-fea15bbd2e57","DOUBLECUP ClickFix Campaign Hides RAT Payloads in Browser Cache via Steganographic PNGs","The DOUBLECUP loader-as-a-service operation exploits ClickFix social engineering lures to trick users into executing malicious commands, bypassing traditional perimeter defenses by abusing trusted browser cache directories to store steganographic PNG files containing encrypted payloads. The use of victim-specific encryption keyed on public IP addresses makes generic signature-based detection ineffective, while EtherHiding-based C2 resolution and DNS\u002FHTTP tunneling allow the malware to evade standard network monitoring. This attack chain demonstrates how layered deception — combining human manipulation, living-off-the-land abuse, and novel payload obfuscation — can defeat organizations that rely solely on endpoint antivirus or static firewall rules. The emergence of a professionally managed, licensed 'loader-as-a-service' lowers the barrier for threat actors and signals a dangerous commoditization of advanced malware delivery infrastructure.","**Immediate actions:**\n- Block or restrict clipboard-hijacking techniques by deploying browser policies that prevent unauthorized script execution triggered by ClickFix-style copy-paste lures.\n- Implement DNS filtering and block known EtherHiding resolution patterns (e.g., blockchain-based DNS lookups) at the network perimeter.\n- Scan browser cache directories on endpoints for anomalous or oversized PNG files using forensic or EDR tooling.\n\n**Detection measures:**\n- Deploy behavioral detection rules in your EDR\u002FSIEM to flag processes reading or decoding binary data from browser cache paths (e.g., `%AppData%\\Local\\...\\Cache`).\n- Monitor outbound DNS and HTTP traffic for tunneling indicators such as unusually long DNS query strings, high query frequency, or non-standard record type usage (TXT, NULL).\n- Alert on steganography-related file access patterns by correlating image file reads with subsequent process injection or network connection events.\n\n**Long-term improvements:**\n- Conduct regular security awareness training with specific scenarios covering ClickFix and copy-paste social engineering attacks to reduce user susceptibility.\n- Enforce application whitelisting and script execution policies (e.g., via AppLocker or WDAC) to prevent unauthorized payloads from executing in user-writable directories.\n- Implement network segmentation to isolate endpoints from direct internet egress, routing all outbound traffic through inspected, authenticated proxies.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AT-2 – Security Awareness Training","NIST SP 800-53 AU-6 – Audit Record Review and Analysis","MITRE ATT&CK T1204 – User Execution","MITRE ATT&CK T1027.003 – Steganography","MITRE ATT&CK T1071.004 – DNS Application Layer Protocol","MITRE ATT&CK T1568 – Dynamic Resolution (EtherHiding)","NIST CSF DE.CM-1 – Network Continuous Monitoring","NIST CSF PR.AT-1 – Security Awareness for All Users",{},"published","2026-08-04T13:20:40.07822+00:00","2026-08-04T13:20:39.76+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fdoublecup-uses-clickfix-and-cached-pngs.html","doublecup-uses-clickfix-and-cached-pngs-to-deliver-countloader-and-devicemanager-79321c","DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":41,"name":42,"slug":43,"description":44,"color":45},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":47,"name":48,"slug":49,"description":50,"color":51},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[53],{"id":54,"date":55,"edition":56,"title":57,"audio_url":58},"abd84ae4-c524-4918-9354-c389de7e7457","2026-08-04","afternoon","ThreatNoir Afternoon Brief — August 4","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-04\u002Fthreatnoir-afternoon-brief-2026-08-04.mp3",[60,64,68],{"slug":61,"name":62,"problem":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":65,"name":66,"problem":67},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":69,"name":70,"problem":71},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]