New DOUBLECUP ClickFix service hides malware in browser cache images
Russian loader-as-a-service DOUBLECUP uses ClickFix lures and steganographic PNG payloads cached by victims' browsers to deliver malware on both Windows and macOS—a novel evasion chain SOCs should prepare for.
Summary written by editorial AI · Source link below
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. [...]
Editorial Analysis
The steganographic browser-cache technique evades conventional file and network inspection, requiring defenders to rethink where they look for payloads.
Update SOC playbooks to include browser-cache forensics and deploy IOCs for DOUBLECUP, CountLoader, and DeviceManager RAT.
A new malware-delivery service hides attacks inside cached browser images, evading traditional security controls on both Windows and Mac systems.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at BleepingComputer in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d