DOUBLECUP ClickFix Loader-as-a-Service
First seen Aug 4, 2026 · Updated Aug 4, 2026
DOUBLECUP is a newly identified Russian loader-as-a-service that leverages ClickFix-style social engineering to trick victims into executing malicious commands, hiding payload code inside PNG images stored in browser caches. The service delivers CountLoader to both Windows and macOS victims and a new Windows-targeted remote access trojan called DeviceManager, expanding the threat actor's toolkit for initial access and persistent remote control.
Technical Analysis
DOUBLECUP employs the ClickFix technique, luring users via fake CAPTCHA/verification prompts into copying and executing malicious PowerShell or terminal commands, a method increasingly favored due to its ability to bypass traditional email and browser-based defenses. The malware conceals its payload using steganographic techniques within PNG images cached by the browser, evading network and endpoint detection that scans for typical executable signatures. Once triggered, it deploys CountLoader (a cross-platform loader affecting Windows and macOS) and DeviceManager, a newly documented Windows RAT enabling remote command execution, persistence, and likely credential/data exfiltration capabilities. The use of a loader-as-a-service model suggests this infrastructure is being rented to multiple threat actors, increasing the scale and diversity of downstream payloads. Organizations running AI agent frameworks or LLM tool-use pipelines on affected endpoints are at risk if developer or automation workstations are compromised via ClickFix social engineering, potentially exposing API keys, credentials, and agent orchestration secrets stored in browser caches or local environments to the deployed RAT.
Affected Systems
Windows workstations and servers (CountLoader, DeviceManager); macOS systems (CountLoader); browsers caching image content (Chrome, Edge, Firefox, Safari) used as the steganographic carrier for payloads
Indicators of Compromise
- CountLoader (loader malware family)
- DeviceManager (Windows RAT)
- ClickFix-style fake verification/CAPTCHA pages
- Malicious PNG images with embedded payloads in browser cache
- Associated PowerShell/terminal execution commands delivered via ClickFix lures
Remediation Steps
- 1
Block ClickFix-style execution vectors
Restrict or monitor use of Windows Run dialog, PowerShell, and macOS Terminal execution triggered by clipboard-paste actions from browser-based prompts; deploy endpoint detection rules for ClickFix patterns.
- 2
Inspect and sanitize browser cache content
Deploy network and endpoint tools capable of detecting steganographic payloads in cached images; clear browser caches on suspected compromised hosts.
- 3
User awareness training
Educate users to never copy-paste or execute commands presented by website 'verification' or CAPTCHA prompts.
- 4
Credential and secret rotation
Rotate API keys, agent credentials, and secrets on any endpoint suspected of compromise, especially developer machines running AI agent tooling or automation scripts.
- 5
Endpoint monitoring for CountLoader/DeviceManager
Update EDR/AV signatures and behavioral detection rules to identify CountLoader and DeviceManager indicators and command-and-control activity.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.