DOUBLECUP Uses Click Fix and Cached PNGs to Deliver Count Loader and Device Manager RAT
Summary: SOCRadar reported that a Russian loader-as-a-service called DOUBLECUP uses ClickFix lures to place a steganographic PNG in the victim's browser cache, retrieve hidden content from it, and execute a second stage that decrypts the final payload in memory using a SHA-256 stream cipher in CTR mode with the victim's public IP address as the key. The service, assessed active since early June 2026, delivers CountLoader variants for Windows and macOS and a Python-based RAT called DeviceManager that resolves its command-and-control infrastructure through Ethereum and Polygon smart contracts.
Bottom line: DOUBLECUP hands operators a licensed client, a payload builder, and a Telegram bot for tracking visits and callbacks, so a single ClickFix landing page can push malware that only decrypts on the intended victim's machine and whose C2 address lives on a public blockchain rather than a domain you can block.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026