New DOUBLECUP ClickFix service hides malware in browser cache images

Overview

A new loader-as-a-service, dubbed DOUBLECUP, has emerged as a significant threat in the cyber landscape, leveraging ClickFix attacks to conceal malicious payloads within browser cache images. This innovative approach allows cybercriminals to deliver malware such as CountLoader and DeviceManager, targeting both Windows and macOS systems. As organizations increasingly rely on web applications, understanding and mitigating this threat is crucial for security teams.

Technical Analysis

DOUBLECUP operates by utilizing a sophisticated method of steganography, embedding malicious code within PNG images that are cached by the victim's browser. This technique allows the malware to bypass traditional detection mechanisms, as the malicious content is hidden within seemingly benign image files. The service, which has been active since early June 2026, provides a Go-based tool for attackers to configure and launch their campaigns with relative ease.

Affected Systems

The DOUBLECUP service primarily targets Windows and macOS platforms. The malware delivered through this service can affect a wide range of applications, particularly those that rely on web-based logins, such as enterprise resource planning (ERP) and customer relationship management (CRM) systems.

Attack Method / Threat Activity

Attacks utilizing DOUBLECUP begin when a customer of the service configures a campaign using a Windows application. This application allows the attacker to specify various parameters, including the domain, URL path, and payload locations. The generated API configuration provides the necessary steganographic image URL and session endpoint.

Once the attacker integrates DOUBLECUP's code into their ClickFix site, a victim visiting the site is prompted by fake CAPTCHA challenges that mimic legitimate login pages for platforms like NetSuite, Odoo, HubSpot, and Salesforce. Upon interaction, the browser is coerced into downloading and caching the malicious PNG image, thereby executing the embedded malware.

Detection Opportunities

To effectively detect DOUBLECUP-related activities, security teams should focus on the following:

• Network Traffic Analysis: Monitor for unusual outbound connections to known DOUBLECUP IP addresses, such as 213.139.77.109.
• Browser Cache Inspection: Implement tools that can analyze cached files for known malicious signatures, particularly within image formats.
• Behavioral Analysis: Utilize SIEM solutions to identify anomalous browser behavior, such as unexpected downloads or cache modifications.

Mitigation Recommendations

Organizations can take several proactive measures to mitigate the risks associated with DOUBLECUP:

• Web Filtering: Employ web filtering solutions to block access to known malicious domains and IP addresses.
• User Education: Conduct training sessions to educate employees about recognizing phishing attempts and suspicious web activity.
• Endpoint Protection: Ensure that endpoint security solutions are up-to-date and capable of detecting steganographic techniques.
• Regular Audits: Perform regular security audits and penetration testing to identify vulnerabilities in web applications.

Business Impact

The emergence of DOUBLECUP poses a significant risk to businesses, particularly those that rely on web-based applications for critical operations. Successful attacks can lead to data breaches, financial losses, and reputational damage. Moreover, the stealthy nature of the malware makes it challenging to detect and remediate, potentially prolonging the impact on organizational resources and operations.

Final Summary

As cyber threats continue to evolve, the DOUBLECUP loader-as-a-service exemplifies the need for organizations to adopt a proactive and multi-layered security approach. By understanding the technical intricacies of this attack vector and implementing robust detection and mitigation strategies, security teams can better protect their enterprises from the growing threat landscape.