The newly identified DOUBLECUP loader-as-a-service demonstrates how cybercriminals are making ClickFix attacks more scalable and difficult to detect. Instead of requiring every attacker to build the complete infection infrastructure, DOUBLECUP provides customers with tools for creating campaigns, hosting malicious images, generating browser-specific commands and rebuilding encrypted payloads automatically. 

The attack begins when a victim visits a malicious website displaying a fake CAPTCHA or verification prompt. The page silently forces the browser to download and cache what appears to be a legitimate PNG image, but the image contains a concealed malware payload. The victim is then instructed to paste and execute a command that searches the browser cache, extracts the hidden code and launches it.

This technique is particularly dangerous because the command itself does not need to download the malware directly from the internet. The malicious content is already present on the device inside the browser cache, allowing the attack to bypass security tools that focus mainly on obvious file downloads or suspicious PowerShell network connections.

DOUBLECUP has been observed impersonating business platforms such as NetSuite, Odoo, HubSpot and Salesforce, making the fake verification prompts more convincing to enterprise users. The service can adapt commands for Chrome, Edge, Firefox, Brave and Opera, demonstrating how cybercrime platforms are increasingly being built to support large-scale, multi-browser campaigns.

The delivered malware includes CountLoader, which can collect system information, search for cryptocurrency wallets and browser extensions, establish persistence and download additional payloads. Researchers also identified DeviceManager, a modular Windows remote-access trojan that uses blockchain smart contracts and DNS communication to obtain command-and-control instructions, making its infrastructure harder to disrupt.

The incident reinforces that trusted browser behaviour should not automatically be considered safe. A browser caching an image is normally harmless, but attackers can abuse that same legitimate process to place malicious content on an endpoint before any suspicious command is executed.

Organizations should monitor unusual commands that search browser-cache directories, use utilities such as `findstr` or `certutil` to extract data from cached files, and execute content from temporary or user-controlled locations. Security teams should also correlate browser activity with subsequent command-line execution rather than evaluating each event independently.

User awareness remains essential because the final stage still depends on convincing the victim to run the attacker’s instructions. Employees should never paste commands into PowerShell, Command Prompt, Terminal or File Explorer because a website claims that a CAPTCHA, update or account verification has failed.

DOUBLECUP demonstrates how ClickFix is evolving from a simple social-engineering technique into a commercial malware-delivery ecosystem. Attackers are combining trusted browser functions, steganography and legitimate system utilities to hide the infection chain from traditional detection.

The broader lesson is that security tools must monitor behaviour and context, not merely file extensions or download events. An image stored in a browser cache may look harmless, but when it is followed by commands that extract hidden code and execute it in memory, the browser cache has effectively become the attacker’s staging directory.

A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. [...]

Source: New DOUBLECUP ClickFix service hides malware in browser cache images via Bleeping Computer — published 03 Aug 2026.