As reported by BleepingComputer, a newly identified Russian loader-as-a-service operation dubbed DOUBLECUP is combining ClickFix social engineering with a particularly cunning payload concealment technique — hiding malicious code inside PNG images stored in victims' browser caches — to deliver multi-stage malware across both Windows and macOS environments.

Threat Alert: The security community has tracked ClickFix-style attacks for some time, but DOUBLECUP represents a meaningful technical evolution.

Why This Technique Deserves Serious Attention

The security community has tracked ClickFix-style attacks for some time, but DOUBLECUP represents a meaningful technical evolution. Rather than dropping payloads to disk in obvious locations or relying solely on in-memory execution, this operation leverages the browser's own cache as a delivery intermediary. This is significant for several reasons:

Why This Technique Deserves Serious Attention
Cache files are routinely ignored by endpoint defenses. Most EDR solutions and AV engines do not aggressively inspect browser cache directories for malicious payloads embedded in image files, creating a reliable blind spot.
PNG steganography is notoriously difficult to detect at scale. Concealing executable content or loader shellcode within the pixel data or metadata of a valid image file defeats signature-based detection and evades many sandboxes that treat image downloads as benign.
ClickFix primes the victim before technical exploitation begins. By manipulating users into executing commands themselves — typically under the guise of CAPTCHA verification or browser error resolution — DOUBLECUP bypasses the need for a traditional drive-by exploit, making it compatible with fully patched systems.

Multi-Platform Reach Amplifies Risk

The deployment of CountLoader across both Windows and macOS is a notable operational choice. Threat actors historically concentrated Windows-focused tooling for financially motivated campaigns, treating macOS as a secondary concern. That calculus is clearly shifting. Security teams protecting mixed-environment organizations — creative agencies, financial firms, tech companies, and any enterprise with significant macOS adoption — must treat this as a genuine dual-platform threat, not a Windows-centric incident with a footnote.

The introduction of DeviceManager, a new remote access trojan delivered to Windows targets, also signals that DOUBLECUP's operators are investing in custom tooling rather than relying on commodity RATs. Custom implants are harder to attribute, slower to detect, and typically designed with specific operational security requirements in mind — suggesting a professionally organized criminal or state-adjacent group rather than opportunistic actors.

The Loader-as-a-Service Model Multiplies Exposure

Perhaps the most important strategic consideration here is the service dimension. When a sophisticated evasion technique is commoditized into a MaaS (Malware-as-a-Service) or LaaS (Loader-as-a-Service) offering, it rapidly proliferates beyond a single threat actor. Organizations should not assume that only high-value targets are at risk. Once DOUBLECUP's infrastructure is rented to lower-tier affiliates, the attack volume will scale substantially across industries.

"A ClickFix attack that bypasses patching cycles, hides payloads in trusted cache directories, and runs as a service should be treated as an enterprise-class threat — not a user-awareness problem alone."

— Shield53 Threat Analysis Team

Detection Signals Defenders Should Hunt For

Given the unconventional delivery path, standard IOC-hunting may be insufficient. Defenders should broaden their detection strategy to include behavioral and heuristic signals:

  • Anomalous process execution from browser cache paths — flag any process spawned from or reading executable content out of %LocalAppData%\[Browser]\User Data\Default\Cache or equivalent macOS paths
  • PowerShell or command-line activity initiated from browser child processes — ClickFix relies on user-executed clipboard commands; correlate browser process trees with shell invocations
  • Outbound connections from newly written binaries — CountLoader and DeviceManager will establish C2; monitor for first-seen binary network activity
  • PNG files with entropy anomalies — image files with unusually high entropy in non-image regions may indicate steganographic payloads; tools like binwalk or custom YARA rules can assist
  • Fake CAPTCHA or browser-error page patterns in proxy/DNS logs — ClickFix lures are often hosted on newly registered or compromised domains with short TTLs

Shield53 Recommendations

Immediate Actions

  • Brief your SOC and IR teams on the ClickFix social engineering chain and the browser cache concealment technique — analyst awareness is your first line of defense here
  • Audit EDR coverage of browser cache directories on both Windows and macOS endpoints; ensure file creation and execution events in these paths are logged and alerted
  • Deploy or update YARA rules targeting high-entropy PNG files and CountLoader/DeviceManager behavioral indicators as threat intelligence becomes available
  • Review user training content to specifically include ClickFix-style lures — traditional phishing awareness training often does not cover fake CAPTCHA or browser error social engineering

Longer-Term Hardening

  • Enforce application allowlisting that prevents execution of binaries from browser cache and temp directories — this alone would neutralize this specific delivery chain
  • Implement Script Block Logging and AMSI to capture PowerShell and script-based execution regardless of obfuscation
  • Consider DNS filtering and web categorization controls to reduce exposure to newly registered domains used as ClickFix lure pages
  • For macOS environments, ensure Endpoint Security Framework (ESF)-based EDR agents are deployed and tuned — macOS detection coverage remains inconsistent across many enterprise deployments

DOUBLECUP is a reminder that threat actors continue to innovate around the edges of what defenders routinely monitor. The browser cache is a trusted, noisy, and largely unwatched data store — exactly the kind of environment sophisticated operators seek out. Organizations that treat this as a commodity threat will be underprepared when the next affiliate campaign arrives.