A newly identified Russian loader‑as‑a‑service, DoubleCup, employs ClickFix lures to embed malicious PNGs in browser caches, enabling the delivery of the CountLoader loader and the previously unknown DeviceManager RAT.
DoubleCup, a new Russian loader‑as‑a‑service (LaaS), has been discovered using ClickFix lures to stage malware‑laden PNG images in victims’ browser caches, ultimately delivering the CountLoader loader and a previously undocumented remote access trojan called DeviceManager.
The initial attack vector relies on the popular ClickFix phishing technique, which lures users into visiting a deceptive URL that triggers the download of a harmless‑looking PNG file.
Once the image is cached by the browser, the first stage of DoubleCup drops a steganographic PNG into the cache. The image itself appears innocuous, but its pixel data contains hidden payloads that the attacker can later extract.
Steganography works by embedding data within the least‑significant bits of an image’s pixels, allowing the hidden content to survive compression and normal viewing.
After the image is cached, DoubleCup’s code scans the cache for the steganographic marker, retrieves the concealed data, and then launches the second stage of the operation.
The second stage executes the CountLoader binary, which is responsible for downloading and installing the final payloads.
CountLoader, already known in the threat‑intel community, is a lightweight loader that can fetch additional modules from command‑and‑control servers.
DeviceManager, the new component of DoubleCup, is a remote access trojan that offers persistence, credential dumping, and full remote control over the compromised host.
By using cached PNG images, DoubleCup bypasses many signature‑based detection mechanisms and reduces the likelihood of triggering browser‑side security alerts.
Security teams are advised to maintain up‑to‑date browsers, avoid clicking on suspicious links, and deploy endpoint detection solutions capable of inspecting cached web content for hidden steganographic data.
DoubleCup, a new Russian loader‑as‑a‑service (LaaS), has been discovered using ClickFix lures to stage malware‑laden PNG images in victims’ browser caches, ultimately delivering the CountLoader loader and a previously undocumented remote access trojan called DeviceManager.
The initial attack vector relies on the popular ClickFix phishing technique, which lures users into visiting a deceptive URL that triggers the download of a harmless‑looking PNG file.
Once the image is cached by the browser, the first stage of DoubleCup drops a steganographic PNG into the cache. The image itself appears innocuous, but its pixel data contains hidden payloads that the attacker can later extract.
Steganography works by embedding data within the least‑significant bits of an image’s pixels, allowing the hidden content to survive compression and normal viewing.
After the image is cached, DoubleCup’s code scans the cache for the steganographic marker, retrieves the concealed data, and then launches the second stage of the operation.
The second stage executes the CountLoader binary, which is responsible for downloading and installing the final payloads.
CountLoader, already known in the threat‑intel community, is a lightweight loader that can fetch additional modules from command‑and‑control servers.
DeviceManager, the new component of DoubleCup, is a remote access trojan that offers persistence, credential dumping, and full remote control over the compromised host.
By using cached PNG images, DoubleCup bypasses many signature‑based detection mechanisms and reduces the likelihood of triggering browser‑side security alerts.
Security teams are advised to maintain up‑to‑date browsers, avoid clicking on suspicious links, and deploy endpoint detection solutions capable of inspecting cached web content for hidden steganographic data.