DOUBLECUP turns your browser cache into an arsenal — Russian loader‑as‑a‑service uses steganography to deliver CountLoader and a brand‑new RAT

August 3, 2026. SOCRadar’s Threat Research Unit published a report documenting DOUBLECUP, a Russian loader‑as‑a‑service operational since early June 2026. Its signature move: weaponising fake CAPTCHA pages to trick victims into executing a clipboard command, then leveraging browser‑cache steganography to deliver CountLoader and a previously undocumented RAT called DeviceManager. The entire kill chain is productised — a licensing panel, a Go‑based builder, and shared backend infrastructure.

DOUBLECUP operates like a criminal SaaS. An operator buys a licence, configures a campaign through a GUI, and the platform generates the front‑end code, hosts the weaponised PNGs, and manages session tracking. The customer only has to paste the output onto a fake login page.

A five‑stage kill chain

SOCRadar discovered DOUBLECUP while investigating an open directory at 213[.]139.77[.]109:9090. The same server hosted the service’s licensing panel. The attack unfolds in five steps:

• CAPTCHA lure. Operators spin up fake login pages impersonating NetSuite, Odoo, HubSpot, or Salesforce. An iframe pulls in DOUBLECUP’s code, which displays a bogus CAPTCHA prompt and silently copies a command to the clipboard.
• Cache poisoning. While the victim stares at the page, the browser downloads and caches a PNG image with malicious code hidden via steganography.
• Social‑engineering execution. The page shows instructions like “Press Win+R, then Ctrl+V, then Enter.” The pasted command invokes findstr or certutil to locate the image in the cache by its exact file size and extract the first‑stage payload.
• Fileless dropper. That payload spawns an in‑memory dropper which retrieves the victim’s public IPv4 address and uses it as a decryption key for the final payload. A hardcoded SHA‑256 hash verifies integrity before execution.
• Final payload. SOCRadar identified two malware families: CountLoader — targeting Windows and macOS for reconnaissance and persistence — and DeviceManager, a modular Python RAT with no prior public documentation.

CountLoader goes cross‑platform

CountLoader is not new, but the variant distributed through DOUBLECUP has evolved. On Windows, it harvests cryptocurrency wallet credentials, checks for the presence of Signal Desktop, and establishes persistence via scheduled tasks. It can also fetch and execute MSI packages, PowerShell modules, and DLLs.

What stands out is the macOS version, compiled for both Intel and Apple Silicon. It drops a LaunchAgent for reboot survival and uses native utilities — curl, sw_vers, system_profiler, ioreg — to phone home. This is a clear signal that DOUBLECUP’s customer base is expanding beyond the traditional Windows monoculture.

DeviceManager: the RAT that reads the blockchain

The second payload delivered by DOUBLECUP is a modular Python RAT for Windows that SOCRadar considers undocumented. Its most notable feature is the use of EtherHiding: the malware queries an Ethereum or Polygon smart contract to resolve the IP address of its command‑and‑control server.

This makes takedowns vastly harder. Blocking an IP or a domain achieves nothing — the smart contract acts as an immutable phonebook for as long as the blockchain exists.

DeviceManager collects the machine GUID, disk identifier, user SID, hostname, OS version, installed antivirus, and domain information. It uses DNS A and TXT records for data exfiltration and command retrieval. Outside Commonwealth of Independent States (CIS) countries, the malware activates its full feature set — a geo‑gating pattern now standard among Russian‑speaking groups.

Why ClickFix + steganography is a hard problem

DOUBLECUP is not the first to marry ClickFix and steganography. Huntress previously documented campaigns where LummaC2 and Rhadamanthys payloads rode inside PNG pixel data. But DOUBLECUP industrialises the technique for any paying customer.

The mechanic is brutally effective because it sidesteps traditional perimeter defences:

• Malicious code never lives in the served HTML. It arrives inside a cached image, decoded only by the locally executed command.
• Proxies and firewalls see an innocuous PNG file, not an executable.
• Antivirus engines do not scan the browser cache with the same depth as the downloads folder.

The attack also exploits a behavioural blind spot. Enterprise security awareness training teaches users to distrust email attachments and suspicious links. It rarely covers the scenario where a legitimate‑looking login page asks you to press Win+R.

Verdict

If you manage Windows or macOS fleets in an organisation that uses NetSuite, Odoo, HubSpot, or Salesforce, this threat targets your users directly. DOUBLECUP operators clone the look of these services because they are hunting employees with access to financial or CRM data.

Three actions to take today:

1. Block certutil and findstr for non‑admin users via AppLocker or GPO — these are the two extractors DOUBLECUP relies on.
2. Deploy a YARA or Sigma rule targeting CountLoader’s network indicators and the pattern of unsigned Python processes querying smart contracts.
3. Train your users to treat “Win+R then Ctrl+V” as an instant red flag — no legitimate service will ever ask you to do this.

For individuals on Windows or macOS, the rule is simple: if a page asks you to open a run dialog and paste text, close the tab immediately.

References

• SOCRadar Threat Research Unit, “DOUBLECUP: A Russian Loader‑as‑a‑Service Exploiting Browser Caches,” August 3, 2026
• Huntress, “Steganography in ClickFix Campaigns,” 2025
• BleepingComputer, “New DOUBLECUP ClickFix service hides malware in browser cache images,” August 3, 2026