DOUBLECUP turns your browser cache into an arsenal — Russian loader‑as‑a‑service uses steganography to deliver CountLoader and a brand‑new RAT

On August 3, 2026, SOCRadar documented DOUBLECUP, a Russian loader-as-a-service active since June 2026 that hides malicious code in browser‑cached PNG images. The ClickFix chain delivers CountLoader to Windows and macOS alongside a previously undocumented DeviceManager RAT steered by smart contracts.