MalwarePublished 3 Aug 2026

New DOUBLECUP ClickFix service hides malware in browser cache images

Source Bleeping Computer

Description

A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. [...]

Impact

The malware delivered by DOUBLECUP enables attackers to gain persistent access to infected Windows and macOS systems. CountLoader facilitates information harvesting, execution of additional payloads, and persistence mechanisms. DeviceManager RAT provides remote access capabilities with enhanced resilience due to its blockchain-based C2 address retrieval, allowing attackers to maintain control and execute arbitrary commands. This compromises confidentiality, integrity, and availability of affected systems.

Defensive guidance

Since this is a malware delivery service leveraging social engineering (clipboard hijacking and fake CAPTCHA prompts), mitigation should focus on user awareness to avoid executing unsolicited commands. Network defenders should monitor for suspicious clipboard activity and unusual browser cache behavior. Endpoint protection solutions should be updated to detect and block CountLoader and DeviceManager malware. There is no indication that an official fix or patch exists for the underlying attack method itself.

References

bleepingcomputer.com/news/security/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Aug 2026, 20:03 UTC

References

Community reviews

Related threats