SOCRadar’s Threat Research Unit says DOUBLECUP has operated since early June 2026, offering a loader‑as‑service that tricks browsers into storing malicious PNGs. That’s the counterintuitive part: a harmless‑looking image becomes a delivery vehicle for sophisticated ransomware‑like payloads.
Key Takeaways
- DOUBLECUP provides a turnkey ClickFix platform that hides malware in cached PNG files.
- Attackers use fake CAPTCHA prompts to copy malicious commands to victims’ clipboards.
- Two payload families – an updated CountLoader for Windows/macOS and a new DeviceManager RAT for Windows – are delivered via the steganographic images.
- Infrastructure is managed by the service, but customers must host the front‑end ClickFix sites and add the generated code.
- Security teams log 54% of successful attacks but only alert on 14%, leaving many infections undetected.
Historical Context
Loader‑as‑a‑service models aren’t new. Earlier campaigns, documented by Huntress, already used PNG pixel data to hide command‑and‑control binaries. Those operations required manual steps: actors had to host images, craft delivery scripts, and manage encryption keys themselves. DOUBLECUP automates that workflow, turning a multi‑person effort into a single‑click purchase. The shift mirrors a broader trend where crime‑as‑a‑service platforms lower technical barriers and accelerate threat proliferation.
That evolution matters because each new layer of automation expands the pool of potential attackers. Where once only seasoned developers could assemble a steganographic pipeline, now a less‑experienced operator can rent the entire stack. The result is a richer threat ecosystem, with more actors capable of deploying ransomware‑style payloads at scale.
DOUBLECUP ClickFix Service: Architecture and Threat Flow
When a criminal buys a license, they get a Go‑based Windows tool that creates a campaign configuration. The tool lets the operator set the domain, URL path, steganography method, embed type, execution action, and payload locations. That’s how the service builds an API endpoint that spits out a steganographic image URL, file size, and a session‑management endpoint tailored for Chrome, Edge, Firefox, Brave, and Opera.
From there, the customer drops the generated JavaScript onto a ClickFix page. The page pulls the configuration, preloads the PNG into the victim’s cache, registers the session, and finally copies a malicious command to the clipboard. That command is the same one the victim sees in a fake CAPTCHA prompt that pretends to be from NetSuite, Odoo, HubSpot, or Salesforce.
We’ve seen the technique before. Huntress documented earlier campaigns that hid LummaC2 and Rhadamanthys payloads in PNG pixel data. This time, the service automates the whole pipeline, from hosting the images to delivering encryption keys.
The configuration phase is more than a simple form. Operators can choose between multiple steganographic methods—least‑significant‑bit encoding, palette manipulation, or chunk‑based hiding. Each method changes how the payload is embedded, which in turn affects the size of the resulting PNG. The API reflects those choices by returning a precise byte count that the browser must download.
Once the JavaScript runs, it establishes a lightweight session with the service. That session tracks the victim’s browser version, operating system, and IP address. The data helps the back‑end select the appropriate payload family—CountLoader for macOS or DeviceManager for Windows—before the image is finally served.
Steganographic PNGs and Browser Cache Abuse
When a user visits the compromised site, the browser is forced to download a PNG whose exact file size matches the value returned by the API. The attacker then runs findstr or certutil on the cache to extract the hidden payload. That’s a clever use of built‑in Windows utilities that many defenders overlook.
Once the first‑stage payload is recovered, it launches a fileless second‑stage dropper. The dropper grabs the victim’s public IPv4 address, uses it to derive a decryption key, checks the decrypted payload against a hard‑coded SHA‑256 hash, and finally executes the payload in memory. No file lands on disk, which makes traditional AV signatures almost useless.
That’s the catch. By keeping the malicious code inside a cached image, the attacker sidesteps many sandbox checks that focus on executable files.
The extraction process exploits the fact that Windows utilities can read arbitrary binary data from text streams. certutil -decodehex turns the raw bytes hidden in the PNG into a usable binary, while findstr can filter out the non‑payload noise. Both commands are native, signed, and rarely flagged by heuristics.
Because the payload lives only in memory, endpoint detection must look for anomalous process behavior—such as a browser spawning a child process that immediately calls certutil. Such patterns are rare in legitimate workflows, making them a reliable indicator of compromise.
Payloads: CountLoader and DeviceManager
The final payloads are two distinct families. The first, an updated CountLoader, targets both Windows and macOS. It harvests system information, looks for cryptocurrency wallets, checks for Signal Desktop, and sets persistence via scheduled tasks. On macOS, it drops a LaunchAgent and uses native tools like curl, sw_vers, and system_profiler to talk to command‑and‑control servers.
The second payload is a previously undocumented Windows RAT called DeviceManager. It’s a modular Python‑based tool that retrieves its C2 address from blockchain smart contracts on Ethereum or Polygon – a technique known as EtherHiding. That makes takedown attempts harder because the address can shift without changing any DNS records.
In non‑CIS countries, DeviceManager gathers the machine GUID, disk identifier, user SID, hostname, username, OS version, architecture, installed AV, and domain info. It then uses DNS A and TXT records to pull commands, download additional payloads, and exfiltrate results.
CountLoader’s persistence mechanisms differ by platform. On Windows, it creates a scheduled task that runs at user logon, pointing to a PowerShell script that re‑downloads the dropper if it disappears. On macOS, the LaunchAgent watches for system sleep events and re‑initiates the connection when the machine awakens.
DeviceManager’s modular design allows attackers to load additional capabilities on demand. A new module might enable keylogging, screen capture, or lateral movement via SMB. Because the core binary is small and written in Python, it can be obfuscated with standard techniques before being injected into memory.
Operational Infrastructure and Customer Role
The service itself hosts the steganographic PNGs, manages session and signal endpoints, and supplies encryption keys. That means operators don’t have to set up their own C2 servers for the first stage. However, customers still need to host the ClickFix pages that display the fake CAPTCHA prompts and embed the generated frontend code.
Customers can also add extra obfuscation or anti‑analysis tricks on top of the provided code. SOCRadar found the licensing panel on the same IP address that served an open directory at 213.139.77.109:9090, indicating that the service runs a centralized control panel for all its clients.
That’s why the ecosystem is concerning: the service lowers the barrier to entry for less‑skilled actors while still giving seasoned operators a flexible platform.
From a defender’s perspective, the centralization creates a single point of failure. If investigators can map the licensing panel to the underlying API, they can disrupt multiple campaigns with one takedown. Yet the use of blockchain for C2 lookups in DeviceManager adds resilience that complicates such efforts.
Customers who host the ClickFix front‑end also inherit the responsibility for any misconfiguration. A missing CSP header or an improperly scoped JavaScript file can expose the entire pipeline to tampering, allowing an attacker to replace the benign PNG with a malicious alternative.
Defensive Recommendations
Defenders should start by monitoring clipboard activity for unexpected commands, especially after visiting sites that use CAPTCHA‑style prompts. Because the malicious command is auto‑copied, any user who pastes the clipboard content into a terminal or PowerShell prompt will execute the payload.
- Audit browser cache directories for anomalous PNG files whose sizes match known payloads.
- Block outbound DNS queries to unknown A and TXT records that could be used by EtherHiding.
- Enable logging of
certutilandfindstrusage, as these are often abused in this technique. - Deploy endpoint detection that flags scheduled‑task creation by unknown binaries.
- Use threat‑intel feeds that include indicators of compromise for the DeviceManager RAT.
We’ve also seen that security teams only log 54% of successful attacks and alert on just 14%. That gap gives attackers plenty of time to move laterally. Improving detection at the cache‑inspection stage could close that gap considerably.
Additional steps include tightening browser policies. Enforcing SameSite attributes on cookies and limiting the size of cached resources can reduce the attack surface. Network segmentation that isolates browsers from privileged environments also helps contain any spillover.
Finally, educate users about the danger of copying and pasting from unexpected prompts. A quick reminder that a legitimate CAPTCHA never asks for command‑line input can stop many executions in their tracks.
What This Means For You
If you’re a developer who embeds third‑party widgets or CAPTCHA services, you need to vet those components for hidden download behavior. Even a seemingly innocuous image can become a covert carrier for malware. Consider adding integrity checks on images before they’re cached, especially if the size changes unexpectedly.
For security architects, the lesson is clear: you can’t rely solely on file‑type heuristics. The DOUBLECUP ClickFix model shows that attackers can blend malicious code into ordinary assets and then pull it out with native OS tools. Layered defenses that watch for unusual clipboard writes, DNS TXT queries, and scheduled‑task creation will give you a fighting chance.
Looking ahead, we might see more loader‑as‑service platforms adopt blockchain‑based C2 lookups, further complicating takedown efforts. The question is whether defenders can keep pace with these increasingly modular threat pipelines.
Three concrete scenarios illustrate the impact. First, a SaaS startup that uses a third‑party CAPTCHA widget may inadvertently serve a malicious PNG to its customers, exposing them to ransomware without ever touching its own codebase. Second, a managed‑service provider that hosts client portals could find its browsers silently caching payloads, leading to cross‑tenant contamination if one tenant is compromised. Third, a security operations center that relies on traditional AV alerts might miss the fileless dropper entirely, allowing the attacker to establish persistence before any alarm sounds.
Each scenario underscores the need for proactive monitoring. Simple script checks that compare image dimensions against known baselines can flag anomalies early. Combined with network‑level DNS filters, such controls create a safety net that catches the threat before it reaches the endpoint.
Key Questions Remaining
How will law‑enforcement agencies disrupt a service that centralizes both licensing and payload delivery? Will they target the IP address that hosts the control panel, or focus on the blockchain contracts that supply C2 addresses? The answer will shape future takedown strategies.
Can defenders develop reliable signatures for the memory‑only dropper, given its reliance on legitimate Windows utilities? Some researchers argue that behavior‑based detection is the only viable path, but that approach demands higher telemetry overhead.
Will browser vendors introduce native defenses against cache‑based steganography, perhaps by limiting the size of cached images or flagging unusual read patterns? If such features land in upcoming releases, the attacker’s window of opportunity could shrink dramatically.
Finally, what role will community‑driven threat‑intel sharing play in tracking the evolving loader‑as‑service ecosystem? Early sharing of IOCs, especially the specific PNG sizes and clipboard commands, could give organizations to block the technique before it spreads widely.
Sources: BleepingComputer, SOCRadar
