New DOUBLECUP ClickFix service hides malware in browser cache images
Russian loader-as-a-service DOUBLECUP uses ClickFix lures and steganographic PNG payloads cached by victims' browsers to deliver malware on both Windows and macOS—a novel evasion chain SOCs should prepare for.
Summary written by editorial AI · Source link below
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. [...]
Editorial Analysis
The steganographic browser-cache technique evades conventional file and network inspection, requiring defenders to rethink where they look for payloads.
Update SOC playbooks to include browser-cache forensics and deploy IOCs for DOUBLECUP, CountLoader, and DeviceManager RAT.
A new malware-delivery service hides attacks inside cached browser images, evading traditional security controls on both Windows and Mac systems.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at BleepingComputer in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d