SOCRadar’s Threat Research Unit documented DOUBLECUP, a loader service that puts a malicious PNG into a visitor’s browser cache before showing a fake CAPTCHA. If the visitor follows the ClickFix instructions, a command already copied to the clipboard searches the cache by the image’s exact file size, extracts the hidden first stage, and runs it. The service then delivers CountLoader on Windows or macOS, or a newly documented Windows remote-access trojan that SOCRadar calls DeviceManager.
The Hacker News separately detailed the same recovered chain. The researchers assess that DOUBLECUP has operated since early June 2026. They recovered a Go-based campaign client, licensing infrastructure, configuration endpoints, test files, payloads, and pages impersonating NetSuite, Odoo, HubSpot, and Salesforce. The finding affects people who reach one of those actor-controlled pages and manually paste and execute its command. Merely loading the page can cache the PNG, but does not by itself execute the malware.
The page prepares the cache before the paste
A DOUBLECUP customer configures a campaign domain, URL path, steganography method, embed type, action, and payload locations in the service’s Windows client. The generated frontend calls /api/config, which returns the PNG URL and file size, a session endpoint, and commands tailored for Chrome, Edge, Firefox, Brave, and Opera.
The landing page preloads the PNG, registers the visit, selects a command from the browser’s user-agent string, and places that command on the clipboard. Its fake CAPTCHA supplies the missing action: persuading the visitor to open a system prompt, paste, and run the command.
On Windows, SOCRadar observed commands using findstr or certutil to locate and recover content from the cached image. That distinction matters in triage. The image request is part of payload staging, while the child process that reads browser-cache files marks the transition from browsing to execution.
The victim’s address becomes a decryption input
The recovered first stage starts a fileless dropper. That dropper retrieves the victim’s public IPv4 address and uses it to derive the key for the encrypted final payload. It checks the decrypted result against a hardcoded SHA-256 value before running it in memory. Replaying the encrypted object from a different public address can therefore fail even when an analyst has the correct bytes.
Figure details
The actor-controlled landing page requests a campaign configuration containing a PNG URL, its exact size, session details, and a browser-specific command. The page preloads the payload-bearing PNG into the browser cache and copies the selected command to the clipboard. The victim must paste and execute it. The command searches the browser cache by exact size and uses findstr or certutil to recover the hidden first stage. A fileless dropper then derives a decryption key from the victim's public IPv4 address, validates the decrypted payload against a hardcoded SHA-256 hash, and runs CountLoader or DeviceManager in memory. Loading the page without executing the pasted command does not complete the chain.
SOCRadar found that CountLoader profiles the host, checks for cryptocurrency-wallet extensions and Signal Desktop, and can retrieve and run executable files, DLLs, MSI packages, PowerShell modules, and archives. Its Windows variant can persist through scheduled tasks. The macOS build supports Intel and Apple silicon and installs a LaunchAgent.
DeviceManager arrives through an Inno Setup package that carries a Python environment. It avoids execution on systems with Commonwealth of Independent States language settings, gathers host and security-product details elsewhere, and uses Ethereum or Polygon smart contracts to resolve its current command-and-control address. It can exchange system data, tasks, payloads, and command output over HTTP or DNS A and TXT records.
SOCRadar’s report establishes the service and recovered campaigns. It does not establish how many visitors pasted the command, how many endpoints ran a final payload, or whether every page and infrastructure address remained active after publication.
Process and cache telemetry connect the stages
Windows defenders need command-line visibility to distinguish an ordinary browser visit from a completed ClickFix action. Microsoft’s process-auditing guidance explains how Security event 4688 can include process command lines when the relevant policy is enabled. Sysmon can add process creation, network connection, DNS query, and file-creation telemetry when configured to retain those events.
Hunt for a browser visit followed by cmd.exe, PowerShell, findstr.exe, or certutil.exe reading browser-cache paths, especially when the command contains an exact file-size test or is followed by script execution without a conventional downloaded installer. Correlate that sequence with the PNG request, the campaign configuration and session endpoints, public-IP lookup traffic, scheduled-task creation, and any later Python, PowerShell, MSI, DLL, or archive execution.
For DeviceManager, examine DNS telemetry for unusual A or TXT queries from a Python process or its packaged parent, and retain the smart-contract lookup and resolved address as separate artifacts. A blocked IP alone is not durable containment because the contract acts as a resolver. For CountLoader on macOS, check LaunchAgents, unified logs, shell history where available, and executions of curl, sw_vers, system_profiler, and ioreg that follow the suspect browser session.
Prove whether the pasted command ran
Preserve the browser profile before clearing it: history, cache entries, the payload-bearing PNG, service and session requests, page scripts, and clipboard-related endpoint telemetry when the product records it. Preserve the extracted stage and memory image when possible. SOCRadar published infrastructure and file indicators that can seed the hunt, including the open test and license-panel host at 213.139.77[.]109:9090, but indicator misses do not close an event because customers supply campaign domains and the service rebuilds payloads.
On Windows, collect Security 4688 or equivalent EDR process records with command lines, scheduled-task events, DNS logs, and child-process ancestry from the browser through the shell and extraction utilities. Treat execution of the staged command as compromise: isolate the endpoint, acquire volatile evidence, scope credentials and sessions available to the user, and investigate follow-on payloads rather than stopping at deletion of the cached PNG.
Treat the case as cache-only when retained browser, process, file, and network records show that the page loaded but no pasted command, extracted stage, or follow-on process ran. Treat it as an execution event until the process tree, persistence, DNS or HTTP command traffic, payloads, and exposed credentials are accounted for and the endpoint is restored to a trusted state. Missing command-line, cache, or DNS telemetry leaves the decisive part of the chain unknown.