A newly developed Russian loader-as-a-service, dubbed DOUBLECUP, utilizes ClickFix lures to inject malicious PNG images into victims' browser caches This article explores clickfix site malware. . The service was active since early June 2026, with core developers providing operators with licenses and a client agent to create campaigns and load payloads by embedding required code in their ClickFix landing pages.
"A GET request to this endpoint yields DOUBLECUP's configuration data, including the steganographic image URL on the target domain, its size, the session endpoint, and browser-specific commands tailored for Chrome, Edge, Firefox, Brave, and Opera." The attack necessitates operators injecting required frontend code onto their ClickFix site.
One malware family that utilizes this method includes an updated version of CountLoader on both Windows and macOS systems, which now incorporates persistence through scheduled tasks, detects installed browser extensions for cryptocurrency wallets, and monitors host profiles to identify if Signal's desktop application is present. It can also run secondary executables, DLLs, MSI files, HTML Application (HTA) files, download compressed archives, extract their contents, and execute the main binary present within the extracted folder. "With its core focus on evasion, DOUBLECUP relies on steganography and environmental keying to circumvent defenses."
CountLoader ingeniously evades process monitoring by copying and header-patching legitimate Windows binaries, while DeviceManager utilizes smart contracts on Ethereum/Polygon blockchains for resilient Command & Control (C2) infrastructure resolution.
