A newly identified malware delivery service, known as DOUBLECUP, has emerged from Russia, employing an innovative technique using ClickFix lures and steganographic PNGs to distribute malicious software. This service targets unsuspecting users by embedding malware within PNG images stored in browser caches, ultimately deploying the CountLoader and a previously undocumented remote access trojan (RAT) named DeviceManager.
Steganographic Techniques and Payload Delivery
According to SOCRadar’s technical analysis, the initial phase involves placing a steganographic PNG file in the browser’s cache, which contains concealed data that activates the next stage of the attack. This subsequent stage decrypts the malware payload in memory, utilizing a custom SHA-256 stream cipher in Counter mode and applying bitwise XOR with the victim’s public IP as the cryptographic key.
The service facilitates the delivery of payloads like CountLoader and DeviceManager across both Windows and macOS. DeviceManager, in particular, employs a technique called EtherHiding to manage its command-and-control (C2) infrastructure, facilitating communication via HTTP or DNS tunneling.
Operational Details and Client Support
DOUBLECUP has been in operation since June 2026, providing clients with licenses and a specialized client agent to support the creation and execution of campaigns. Each license is unique, containing metadata such as the client’s IP address, active days, label, and version. This allows operators to manage multiple campaigns per license.
The Windows-based GUI client allows operators to update configurations and issue commands through a Broadcast Pane, while a Payload Builder Pane helps set up commands triggered by ClickFix decoys. These decoys configure domains, steganography methods, and payload URLs, creating a configuration endpoint for retrieving DOUBLECUP’s setup data.
Advanced Obfuscation and Threat Management
To execute the attack, operators must inject specific frontend code onto their ClickFix sites. This involves fetching configuration data, prefetching the image, and evaluating browser User-Agent strings to select suitable payloads. The process culminates with a polling mechanism to execute the final redirect, potentially incorporating additional obfuscation tactics at the operator’s discretion.
A Telegram bot is used for tracking client interactions, delivering commands, and managing payload callbacks via a designated URL. The bot is allegedly managed by a threat actor known as “johnnysilverhe,” who also published a suspicious Visual Studio Code extension.
Implications and Future Outlook
DOUBLECUP campaigns have utilized fake CRM login sites to distribute loaders, which execute ClickFix commands to extract malicious scripts from the browser cache. Upon infection, the C2 server is alerted, and further payload deployment is triggered, employing environmental keying to ensure activation solely on targeted machines.
The sophisticated use of steganography and environmental keying by DOUBLECUP demonstrates a significant evolution in malware delivery methods, offering threat actors a reliable and evasive payload distribution channel. As cybersecurity defenses advance, the need for vigilance and innovative countermeasures continues to grow.
