--- title: New DOUBLECUP ClickFix service hides malware in browser... description: A new Russian loader-as-a-service called DOUBLECUP has been active since June 2026, using ClickFix social engineering attacks to deliver malware hidden inside... canonical: https://daily.dev/posts/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images-jncprcbr3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New DOUBLECUP ClickFix service hides malware in browser cache images | daily.dev og:description: A new Russian loader-as-a-service called DOUBLECUP has been active since June 2026, using ClickFix social engineering attacks to deliver malware hidden inside... og:url: https://daily.dev/posts/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images-jncprcbr3 og:image: https://api.daily.dev/og/posts/JncpRCBR3.png og:image:alt: New DOUBLECUP ClickFix service hides malware in browser cache images og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New DOUBLECUP ClickFix service hides malware in browser cache images **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 1 upvotes · 0 comments ## Summary A new Russian loader-as-a-service called DOUBLECUP has been active since June 2026, using ClickFix social engineering attacks to deliver malware hidden inside PNG images cached by victims' browsers. When a victim visits a fake CAPTCHA page impersonating services like NetSuite, HubSpot, or Salesforce, the browser silently caches a steganographic PNG. The victim is tricked into running a clipboard-injected command that extracts and executes the hidden payload from the cache. The attack chain delivers CountLoader (targeting Windows and macOS) for system reconnaissance, cryptocurrency wallet detection, and persistence, as well as a newly documented Python-based RAT called DeviceManager. DeviceManager uses EtherHiding — retrieving its C2 server address from Ethereum/Polygon smart contracts — making it highly resistant to takedown. The service is sold as a platform with licensing, infrastructure hosting, and a Go-based campaign builder. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the DOUBLECUP ClickFix malware service and how does it hide code in images? DOUBLECUP is a Russian loader-as-a-service, active since early June 2026, that uses ClickFix-style fake CAPTCHA prompts to trick victims into running clipboard commands. It forces the browser to cache a steganographic PNG image, then uses commands like findstr or certutil to extract a hidden first-stage payload from the cached file based on its exact file size. _Security teams tracking emerging ClickFix and steganography techniques can follow threat research like this on daily.dev._ ### What malware payloads does the DOUBLECUP loader service deliver? DOUBLECUP delivers an updated cross-platform version of CountLoader, which targets both Windows and macOS, and a newly documented Python-based Windows remote access trojan called DeviceManager. CountLoader harvests system data, checks for crypto wallets and Signal Desktop, and can download MSI packages, PowerShell modules, and DLLs, while DeviceManager collects machine identifiers and system details. _Anyone defending endpoints against loader-as-a-service threats can track payload details like these on daily.dev._ ### How does the DeviceManager RAT use EtherHiding and blockchain smart contracts? DeviceManager, a modular Python-based Windows RAT delivered by DOUBLECUP, uses EtherHiding to retrieve its current command-and-control address from an Ethereum or Polygon smart contract, making takedown efforts harder. It then uses DNS A and TXT records to steal system information, fetch commands, download payloads, and exfiltrate command output. _Defenders researching blockchain-based C2 evasion like EtherHiding can keep up with cases like this on daily.dev._ ## Similar posts on daily.dev - [Fake Google and Cloudflare verification pages spread multiple malware families](https://daily.dev/posts/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families-8s8xqrwfw) · Security Boulevard · 0 upvotes · 0 comments - [The Psychedelic Stealer: When a CAPTCHA Becomes an Installer](https://daily.dev/posts/the-psychedelic-stealer-when-a-captcha-becomes-an-installer-tnkoogclu) · Arctic Wolf · 1 upvotes · 0 comments - [ClickFix techniques evolve in new infostealer campaigns](https://daily.dev/posts/clickfix-techniques-evolve-in-new-infostealer-campaigns-mufrpsfhw) · CSO Online · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images-jncprcbr3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New DOUBLECUP ClickFix service hides malware in browser cache images","url":"https://daily.dev/posts/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images-jncprcbr3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images-jncprcbr3"},"datePublished":"2026-08-03T20:02:13.122Z","dateModified":"2026-09-14T08:59:56.084Z","description":"A new Russian loader-as-a-service called DOUBLECUP has been active since June 2026, using ClickFix social engineering attacks to deliver malware hidden inside...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/61bec7a7ea743aa33ea02c891e772699?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/61bec7a7ea743aa33ea02c891e772699?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images-jncprcbr3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"New DOUBLECUP ClickFix service hides malware in browser cache images"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images-jncprcbr3#faq","mainEntity":[{"@type":"Question","name":"What is the DOUBLECUP ClickFix malware service and how does it hide code in images?","acceptedAnswer":{"@type":"Answer","text":"DOUBLECUP is a Russian loader-as-a-service, active since early June 2026, that uses ClickFix-style fake CAPTCHA prompts to trick victims into running clipboard commands. It forces the browser to cache a steganographic PNG image, then uses commands like findstr or certutil to extract a hidden first-stage payload from the cached file based on its exact file size. Security teams tracking emerging ClickFix and steganography techniques can follow threat research like this on daily.dev."}},{"@type":"Question","name":"What malware payloads does the DOUBLECUP loader service deliver?","acceptedAnswer":{"@type":"Answer","text":"DOUBLECUP delivers an updated cross-platform version of CountLoader, which targets both Windows and macOS, and a newly documented Python-based Windows remote access trojan called DeviceManager. CountLoader harvests system data, checks for crypto wallets and Signal Desktop, and can download MSI packages, PowerShell modules, and DLLs, while DeviceManager collects machine identifiers and system details. Anyone defending endpoints against loader-as-a-service threats can track payload details like these on daily.dev."}},{"@type":"Question","name":"How does the DeviceManager RAT use EtherHiding and blockchain smart contracts?","acceptedAnswer":{"@type":"Answer","text":"DeviceManager, a modular Python-based Windows RAT delivered by DOUBLECUP, uses EtherHiding to retrieve its current command-and-control address from an Ethereum or Polygon smart contract, making takedown efforts harder. It then uses DNS A and TXT records to steal system information, fetch commands, download payloads, and exfiltrate command output. Defenders researching blockchain-based C2 evasion like EtherHiding can keep up with cases like this on daily.dev."}}]} ```