DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

1. Executive summary

A Russian loader-as-a-service (LaaS) operation codenamed DOUBLECUP has been active since early June 2026, using ClickFix social-engineering lures on fake CRM login pages (NetSuite, Odoo, HubSpot, Salesforce) to deliver the CountLoader payload and a previously undocumented RAT called DeviceManager. The delivery chain uses steganographic PNG images cached in the victim's browser, from which malicious JavaScript, VBScript, or PowerShell is extracted and executed. Attribution to a Russian LaaS is unconfirmed — DOUBLECUP has no MITRE ATT&CK profile in the verified reference data, and the assessment rests on a single vendor report (SOCRadar). EMEA financial services staff are exposed via typical credential-phishing workflows that impersonate business CRM platforms; successful execution yields memory-resident decrypted payloads and a RAT with HTTP and DNS-tunneling C2.

2. Regulatory framing

No NIS2 or UK NIS article is specifically engaged beyond generic incident-management obligations. The supply-chain vector here is a malicious VS Code extension published by an actor linked to the DOUBLECUP bot — this does not engage NIS2 Art. 21(2)(d) supply-chain security measures because the extension is not part of the entity's ICT supply chain unless an employee installs it.

3. Technical analysis & attack chain

Attribution caveat: DOUBLECUP is assessed as a Russian LaaS by SOCRadar. This attribution is unconfirmed — DOUBLECUP has no MITRE ATT&CK profile in the verified reference data, and the entire technical assessment rests on a single vendor report (SOCRadar, via The Hacker News). Treat attribution and IOC sets as single-sourced; verify before enforcement.

Attack chain (confirmed from source)

1. Initial access — ClickFix lure on fake CRM page. The victim visits a bogus site impersonating a CRM login page (observed brands: NetSuite, Odoo, HubSpot, Salesforce). The page contains an embedded iframe element that loads the DOUBLECUP ClickFix landing page.
2. Configuration fetch. Frontend code injected by the operator on the ClickFix site fetches the configuration endpoint at https://{domain}/{slug}/api/config via a GET request. The response contains: the steganographic image URL hosted on the target domain, image size, the session endpoint, and browser-specific commands tailored for Chrome, Edge, Firefox, Brave, and Opera.
3. Image prefetch and session registration. The steganographic PNG image is prefetched (cached in the browser). A session is registered with the C2 server. The victim's browser User-Agent string is evaluated to select the appropriate browser-matched payload.
4. Clipboard manipulation. ClickFix instructions are displayed to the victim. The browser-matched command is copied to the victim's clipboard. A polling mechanism is initiated to execute the final redirect.
5. Payload execution from cached PNG. Upon the victim executing the clipboard command, the command searches the browser cache for the steganographic PNG image and extracts hidden malicious JavaScript, VBScript, or PowerShell from it. This launches the second-stage component. The C2 server is notified of successful infection.
6. In-memory decryption. The second stage decrypts the final payload in memory using a custom SHA-256 stream cipher in Counter (CTR) mode combined with bitwise XOR, keyed on the victim's public IP address (environmental keying / anti-analysis).
7. Dropper and redirect. The second stage acts as a dropper: it deploys the encrypted payload and redirects the victim to a destination page.

Payloads

• CountLoader — a loader with variants for both Windows and macOS. No further technical detail on capabilities provided in the source.
• DeviceManager — a previously undocumented RAT. It uses EtherHiding to resolve its C2 infrastructure and communicates with the C2 server over HTTP or DNS tunneling. No further capability detail provided.

Operator infrastructure and tooling

• License panel — discovered via an open directory at 213.139.77[.]109:9090 containing testing files later identified as part of the DOUBLECUP license panel. Each license comes with a unique key and metadata: client IP address, active days, label, and version. Multiple campaigns can be orchestrated per license.
• Go-based Windows GUI client — provides operators with: configuration updates, software updates, a Broadcast Pane for issuing commands directly, and a Payload Builder Pane for setting up ClickFix-triggered commands. The builder allows operators to configure: domain, slug, steganography method, embed type, archive format, action, and payload URLs.
• Telegram bot — @harrypoterlohBOT is used to track client visits, send commands, deliver keys, and receive payload callbacks via a designated DOUBLECUP URL. The bot is managed by a threat actor using the handle "johnnysilverhe."
• VS Code extension — "johnnysilverhe" has published a suspicious Microsoft Visual Studio Code extension named Agent IDE in the official marketplace. The source does not describe its capabilities or confirm it is malicious; treat as suspicious and single-sourced.

Anti-analysis: Environmental keying using the victim's public IP address as the decryption key means the payload will fail to decrypt in analysis environments with different IP addresses. Operators may also incorporate additional obfuscation, but this is their individual responsibility, not a platform feature.

4. Mitigation & containment

P1 — Within 24 hours

• Block the known infrastructure: Add 213.139.77[.]109 to firewall, proxy, and EDR blocklists. Monitor for any outbound connections to this IP on port 9090 or any port.
• Block the Telegram bot handle: Add @harrypoterlohBOT to allowed/denied lists in any corporate Telegram or messaging monitoring controls. Monitor for this handle in endpoint messaging telemetry if feasible.
• Audit for the VS Code extension: Search endpoint management telemetry for the extension name Agent IDE by publisher "johnnysilverhe." If found on any developer workstation, quarantine the machine, preserve the extension for forensic review, and revoke any credentials accessed from that machine. Note: the source flags this extension as suspicious but does not confirm malicious behaviour — treat as precautionary.
• Hunt for ClickFix TTPs: Search web proxy logs and DNS logs for requests matching the pattern https://{domain}/{slug}/api/config — specifically any /api/config endpoint on domains impersonating CRM platforms (NetSuite, Odoo, HubSpot, Salesforce). Flag any hits for incident response.
• DNS tunneling detection: Enable or verify DNS tunneling detection on recursive resolvers and DNS firewalling. DeviceManager uses DNS tunneling for C2 — look for high-volume TXT or NULL record queries to a single domain, unusually long subdomain labels, or high-entropy DNS query patterns.

P2 — Within 72 hours

• Browser cache monitoring: Develop detection for PowerShell, VBScript, or JavaScript execution originating from browser cache directories (e.g., %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache\, equivalent paths for Edge, Firefox, Brave, Opera). This is the extraction point for the steganographic PNG payload.
• Clipboard-injection-to-execution detection: Deploy or tune EDR rules for the ClickFix pattern: a browser process writing to the clipboard followed by powershell.exe, cscript.exe, wscript.exe, or cmd.exe executing clipboard content shortly after. The clipboard content will contain a command that searches the browser cache.
• Steganographic PNG detection: Evaluate endpoint DLP or EDR capabilities for scanning PNG files in browser cache for embedded data. The source does not specify the steganography method used, so generic steganography-detection tooling should be evaluated.
• CRM impersonation blocking: Add the observed impersonated CRM domains to DNS blocklists or web proxy deny categories. Validate that legitimate CRM access is through SSO or known-good URLs, and alert on any credential entry to CRM-looking pages outside the corporate SSO flow.

P3 — Within 7 days

• User awareness: Brief staff — particularly sales, marketing, and finance functions who use CRM platforms — on the ClickFix social-engineering pattern: a webpage displaying a fake "verification" or "captcha" prompt that instructs the user to press Win+R, paste a command, and execute it. This is the human-execution step that makes the attack chain work.
• macOS endpoint coverage: CountLoader has a macOS variant. Verify that macOS endpoints in the estate have equivalent EDR coverage and that browser cache monitoring rules apply to macOS browser cache paths.
• Threat-intel feed update: Ensure the DOUBLECUP IOCs and TTPs are added to the organisation's threat-intel platform and that SIEM detection rules reference the behavioural patterns described above.

5. Indicators of compromise

ipv4  213.139.77[.]109
telegram-handle  @harrypoterlohBOT
vscode-extension  Agent IDE
actor-handle  johnnysilverhe

Behavioural indicators

6. Detection

rule DOUBLECUP_ClickFix_Stego_PNG_Loader {
    meta:
        author = "Adverse Trace"
        date = "2026-08-04"
        reference = "https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html"
        description = "Detects DOUBLECUP configuration endpoint and steganographic PNG payload delivery artefacts"
    strings:
        $config_endpoint = "/api/config" ascii
        $stego_img_url = "steganographic image URL" ascii
        $session_endpoint = "session endpoint" ascii
        $browser_cmd_chrome = "Chrome" ascii
        $browser_cmd_edge = "Edge" ascii
        $browser_cmd_firefox = "Firefox" ascii
        $browser_cmd_brave = "Brave" ascii
        $browser_cmd_opera = "Opera" ascii
        $sha256_ctr = "SHA-256" ascii
        $ctr_mode = "CTR" ascii
        $etherhiding = "EtherHiding" ascii
        $devicemanager = "DeviceManager" ascii
        $countloader = "CountLoader" ascii
    condition:
        3 of them
}

title: DOUBLECUP ClickFix Execution from Browser Cache
id: AT-2026-08-04-458-001
status: experimental
description: Detects execution of script interpreter following clipboard write by browser process, consistent with DOUBLECUP ClickFix delivery
author: Adverse Trace
date: 2026/08/04
references:

    - https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html
logsource:
    product: windows
    category: process_creation
detection:
    selection_script:
        Image|endswith:

            - '\powershell.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\cmd.exe'
    filter_cache_path:
        CommandLine|contains:

            - 'Cache'
            - 'cache'
    filter_browser_parent:
        ParentImage|endswith:

            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection_script and filter_cache_path
falsepositives:

    - Legitimate browser cache cleanup scripts (unlikely to originate from browser parent process)
level: high

title: DOUBLECUP Configuration Endpoint Access
id: AT-2026-08-04-458-002
status: experimental
description: Detects HTTP GET requests to DOUBLECUP configuration endpoint pattern /api/config on CRM-impersonating domains
author: Adverse Trace
date: 2026/08/04
references:

    - https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html
logsource:
    product: proxy
detection:
    selection_config_endpoint:
        c-uri|contains: '/api/config'
    filter_crm_impersonation:
        c-uri|contains:

            - 'netsuite'
            - 'odoo'
            - 'hubspot'
            - 'salesforce'
    condition: selection_config_endpoint and filter_crm_impersonation
falsepositives:

    - Legitimate CRM API access using /api/config path (verify against known-good CRM domains and SSO)
level: high

7. Sources

• The Hacker News, "DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT," https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html, 2026-08-04. (Reporting on SOCRadar technical analysis.)

8. Adverse Trace position

This is a medium-severity threat to EMEA financial services. The attack chain requires user execution of clipboard-injected commands (ClickFix), which limits blast radius to socially-engineered victims — but the in-memory decryption with environmental keying, DNS-tunneling C2, and macOS variant coverage make post-compromise detection difficult. The impersonation of CRM platforms (NetSuite, Odoo, HubSpot, Salesforce) directly targets business workflows common in financial services front-office and mid-office functions. Attribution to a Russian LaaS and all IOCs are single-sourced from SOCRadar via The Hacker News; DOUBLECUP has no MITRE ATT&CK profile in the verified reference data, so attribution is unconfirmed. We will monitor for corroboration from additional vendors and for any confirmed DOUBLECUP campaigns targeting EMEA financial sector employees. Clients should prioritise P1 infrastructure blocking and DNS-tunneling detection, and brief CRM-using staff on the ClickFix execution pattern.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.