A sophisticated Russian loader-as-a-service (LaaS) operation known as DOUBLECUP is actively targeting systems by utilizing ClickFix lures to initiate a multi-stage infection process. According to The Hacker News, this campaign leverages cached PNG files to bypass standard security filters, eventually dropping the CountLoader payload and a previously undocumented remote access trojan (RAT) identified as DeviceManager.
The attack sequence relies on steganography to conceal malicious code within image files. Once a victim interacts with a ClickFix-based prompt, the system is coerced into downloading a PNG file directly into the browser's local cache. From there, the loader extracts hidden instructions from the image data to trigger the subsequent infection phases. The ultimate objective of this operation is the establishment of persistent unauthorized access through the DeviceManager RAT.
Infection Mechanism Overview
| Component | Function |
|---|---|
| DOUBLECUP | Loader-as-a-Service (LaaS) framework |
| ClickFix | Initial lure mechanism for user interaction |
| PNG Cache | Delivery vehicle for steganographic payloads |
| CountLoader | Secondary stage loader |
| DeviceManager | Undocumented remote access trojan (RAT) |
Security researchers have noted that the use of cached image files represents an evolving tactic in the LaaS market, aimed at circumventing endpoint detection and response (EDR) solutions that may be configured to inspect standard executable downloads but overlook browser-cached resources. This method of obfuscation allows the threat actors to maintain a low profile during the initial ingress of the malware.
Why It Matters
The emergence of DOUBLECUP highlights a shift toward more complex, multi-layered distribution models in the cyber-mercenary ecosystem. By decoupling the initial lure (ClickFix) from the final payload (DeviceManager) and utilizing browser cache as a temporary staging ground, threat actors are forcing security providers to rethink how they monitor browser-side file system interactions. This trend suggests that attackers are increasingly moving away from simple malicious attachments toward 'living-off-the-web' tactics that exploit standard browser functionality, making it significantly harder for traditional signature-based detection systems to identify threats before execution occurs.
Reader Discussion & Insights