DOUBLECUP ClickFix hides malware in a browser-cache PNG

DOUBLECUP is a Russian-language loader-as-a-service that turns the popular ClickFix technique into a packaged product for other threat groups. A victim sees a fake sign-in or CAPTCHA and a supposed repair instruction. The prepared command recovers the next stage from a PNG that the browser has already placed in its local cache, avoiding an obvious executable download from a suspicious address at execution time.

SOCRadar has observed the service since early June 2026. Its operator sells licences, a Go-based Windows campaign builder, image hosting, session and signal endpoints, and the keys required to prepare payloads. Customers supply the lure and choose the payload while the platform automates the technical middle of the chain.

From a browser PNG to in-memory code

Lure pages imitate services including NetSuite, Odoo, HubSpot and Salesforce. An embedded frame loads the data-bearing PNG and registers the session. The image is in the browser cache before the user copies anything.

Clicking the fake verification places a browser-specific command on the clipboard. Because the script knows the image’s exact size, it can search cache files for the correct object. It uses legitimate Windows utilities such as findstr or certutil to recover the hidden data.

The next stage runs in memory. Its decryption key is derived from the victim’s public IPv4 address and integrity is checked with SHA-256. That design binds the payload to a session and frustrates analysis outside the victim environment. It does not make the attack invisible: defenders can still observe a browser spawning interpreters, cache access, LOLBin use, network activity and the next-stage behaviour.

CountLoader and DeviceManager

SOCRadar describes two principal payloads. CountLoader supports Windows and macOS, establishes persistence, profiles the host and retrieves further components. DeviceManager is a Python RAT for Windows with remote control, command execution and data-theft capabilities.

DeviceManager also uses EtherHiding: C2 configuration can be stored in Ethereum or Polygon smart contracts. The malware queries the chain for a current address, so blocking one domain is insufficient. It additionally uses DNS A and TXT records for signalling, commands or data transfer. The result combines channels that many organisations still treat as ordinary infrastructure traffic.

Why ClickFix keeps working

The technique does not require a browser vulnerability. It exploits users’ desire to fix an error and the authority of a CAPTCHA interface. Any instruction asking someone to open a terminal, paste a command and run it should be treated like an executable attachment, even when the page resembles a familiar SaaS application.

Automatically copying code to the clipboard shortens the decision point. The victim does not need to understand the command, while polished visuals make the process feel like part of authentication. URL filtering alone therefore cannot solve the problem.

Layered defense

Organisations should:

• teach users that a CAPTCHA or sign-in never requires PowerShell, a terminal or the Run dialog;
• block or constrain unnecessary interpreters and LOLBins with application control;
• alert on browser → cmd/PowerShell/certutil/findstr process chains;
• monitor script processes reading browser-cache locations;
• control unusual DNS TXT queries and public blockchain RPC access from user endpoints;
• isolate hosts after suspicious command execution and revoke stolen sessions, rather than only deleting a file;
• rehearse ClickFix triage in incident-response exercises.

Related mechanisms appear in our analysis of ClickFix and EtherHiding on macOS and our incident-response plan.

Primary facts versus Breachroad analysis

SOCRadar documents the infrastructure, builder, lures and analysed payloads. BleepingComputer independently covers the discovery. Claims about the service’s origin and commercial offering derive from researcher observations and seller material; they are not legal attribution of named operators.

Breachroad’s conclusion is to treat browser cache as part of the execution surface and hunt the complete behaviour chain, not a single PNG. Cybersecurity and phishing training prepares staff for ClickFix, while an IT security audit can assess application control, EDR, DNS visibility and host-isolation procedures.