DOUBLECUP is a loader-as-a-service active since June 2026 that leverages ClickFix attacks embedding malicious code steganographically in PNG images cached by browsers. Operators configure campaigns using a Go-based Windows tool that generates code for various browsers to preload these images and copy execution commands to victims' clipboards. Upon execution, these commands extract and run a first-stage payload from the cached PNG image, which then launches a fileless second-stage dropper. This dropper decrypts and executes the final payload in memory, delivering CountLoader and DeviceManager malware. CountLoader targets Windows and macOS, harvesting system information, checking for cryptocurrency wallets and Signal Desktop, and establishing persistence. DeviceManager is a modular Python-based Windows RAT that uses blockchain smart contracts (Ethereum or Polygon) to dynamically obtain its C2 server IP, making it resistant to disruption. It collects detailed system and user information and uses DNS records for command and control.

The malware delivered by DOUBLECUP enables attackers to gain persistent access to infected Windows and macOS systems. CountLoader facilitates information harvesting, execution of additional payloads, and persistence mechanisms. DeviceManager RAT provides remote access capabilities with enhanced resilience due to its blockchain-based C2 address retrieval, allowing attackers to maintain control and execute arbitrary commands. This compromises confidentiality, integrity, and availability of affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a malware delivery service leveraging social engineering (clipboard hijacking and fake CAPTCHA prompts), mitigation should focus on user awareness to avoid executing unsolicited commands. Network defenders should monitor for suspicious clipboard activity and unusual browser cache behavior. Endpoint protection solutions should be updated to detect and block CountLoader and DeviceManager malware. There is no indication that an official fix or patch exists for the underlying attack method itself.