**SOCRadar**'s Threat Research Unit has identified **DOUBLECUP** as an active threat since early June 2026. This service offers a comprehensive platform for cybercriminals, providing licenses and a **Go**-based Windows tool to craft malicious campaigns and generate the necessary code for their websites. **DOUBLECUP** streamlines the attack infrastructure, handling crucial elements such as hosting steganographic PNG images, managing session and signal endpoints, supplying encryption keys, and automating payload rebuilding. While **DOUBLECUP** manages the backend, its customers are responsible for developing and hosting the websites that feature the **ClickFix** prompts. They integrate the generated frontend code and can implement additional obfuscation or anti-analysis measures. **SOCRadar**'s discovery of **DOUBLECUP** stemmed from an investigation into an open directory at `213[.]139.77[.]109:9090`, which contained test files. This same IP address was later found to host the service's licensing panel. To initiate an attack, a **DOUBLECUP** subscriber utilizes the **Go**-based Windows application to configure campaign specifics: domain, URL path, steganography method, embed type, execution action, and payload locations. This process generates an API configuration endpoint that provides the steganographic image URL and file size, session endpoint, and commands tailored for various browsers including **Chrome**, **Edge**, **Firefox**, **Brave**, and **Opera**. Operators then embed **DOUBLECUP**'s code into their **ClickFix** sites. This code retrieves the configuration, preloads the steganographic image into the victim's browser cache, registers the session, selects the appropriate command for the victim's browser, and copies it to the clipboard upon page load. ## Malware Hidden in the Browser Cache In a [new report](https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/), **SOCRadar** details **DOUBLECUP ClickFix** campaigns employing fake CAPTCHA prompts on login pages. These pages impersonate popular services such as **NetSuite**, **Odoo**, **HubSpot**, and **Salesforce**, with the malicious code delivered via embedded iframes. Upon visiting one of these compromised sites, **DOUBLECUP** registers the session, identifies the victim's public IP address, and forces the browser to download and cache a malicious PNG image. The page then presents deceptive CAPTCHA-style instructions, attempting to trick visitors into pasting and executing a command that has been automatically copied to their clipboard.  Once executed, the command scans the browser cache for the specific PNG image using its file size. It then leverages `findstr` or `certutil` commands to extract and execute the hidden first-stage payload embedded within the image. This initial payload launches a fileless second-stage dropper, which retrieves the victim's public IPv4 address. This address is subsequently used to generate a decryption key for the final encrypted payload. After verifying the decrypted payload against a hardcoded **SHA-256** hash, the dropper executes it in memory. **SOCRadar** reports that the ultimate payloads are **CountLoader** and the newly identified **DeviceManager RAT**. ## Two Malware Payloads **SOCRadar** has identified two distinct malware families delivered by **DOUBLECUP**: an updated version of **CountLoader** targeting both Windows and macOS, and what is believed to be a previously undocumented **DeviceManager RAT**. **CountLoader** is designed for extensive system information harvesting. It checks for cryptocurrency wallet applications and browser extensions, determines if **Signal Desktop** is installed, and establishes persistence through scheduled tasks. Furthermore, **CountLoader** can download and execute various files, including **MSI** packages, **PowerShell** modules, and **DLLs**. **SOCRadar** also recovered a macOS version of **CountLoader**, compiled for both **Intel** and **Apple Silicon** devices. This variant installs a **LaunchAgent** for persistence and utilizes built-in utilities like `curl`, `sw_vers`, `system_profiler`, and `ioreg` to communicate with attacker-controlled servers. **DOUBLECUP** has also been observed delivering the **DeviceManager** malware, a modular **Python**-based Windows RAT. Notably, **DeviceManager** employs blockchain smart contracts to determine the IP address of its command-and-control (**C2**) server. In regions outside the Commonwealth of Independent States (**CIS**), **DeviceManager** collects critical system information, including machine GUID, disk identifier, user SID, hostname, username, operating system version, architecture, installed antivirus software, and domain details. The malware utilizes a technique known as **EtherHiding** to retrieve its current C2 address from an **Ethereum** or **Polygon** smart contract, enhancing its resilience against disruption attempts. The **RAT** leverages **DNS A** and **TXT** records to exfiltrate system information, receive commands for execution, download additional payloads, and relay command output back to the attackers. This isn't the first instance of **ClickFix** attacks incorporating steganography. **Huntress** previously documented campaigns that concealed **LummaC2** and **Rhadamanthys** payloads within the pixel data of PNG images.