GoKawiilA new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems.
SOCRadar's Threat Research Unit says DOUBLECUP has operated since early June 2026, providing customers with licenses and a Go-based Windows tool for creating malicious campaigns and generating the code operators add to their websites.
The service handles much of the infrastructure required to conduct the attacks, including hosting the steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads.
DOUBLECUP customers are responsible for creating and hosting the websites used to display the ClickFix prompts, adding the generated frontend code, and implementing any additional obfuscation or anti-analysis measures.
SOCRadar discovered DOUBLECUP while investigating an open directory at 213[.]139.77[.]109:9090 that contained test files. The same IP address was later identified as hosting the service's licensing panel.
To launch an attack, a DOUBLECUP customer uses the Go-based Windows application to configure the campaign's domain, URL path, steganography method, embed type, execution action, and payload locations.
This generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for Chrome, Edge, Firefox, Brave, and Opera.
Operators then add DOUBLECUP's code to their ClickFix sites, which retrieves the configuration, preloads the steganographic image into the victim's browser cache, registers the session, selects the command matching the victim's browser, and copies it to the clipboard when the page is opened.
Malware hidden in the browser cache
In a new report, SOCRadar says it observed DOUBLECUP ClickFix campaigns using fake CAPTCHA prompts on login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce, with the malicious code loaded through embedded iframes.
... continue reading