DOUBLECUP Loader-Service Spreads Malware via ClickFix Lures

Russian threat actors have been operating a loader-as-a-service (LaaS) called DOUBLECUP, which uses ClickFix lures to deliver malware-laced PNG images in victims' browser cache. The service has been active since early June 2026 and allows operators to license the software with unique keys containing metadata.

DOUBLECUP retrieves its hidden content from the steganographic PNG image, executes a second stage, and decrypts the final payload via a custom SHA-256 stream cipher in Counter (CTR) mode using the victim's public IP address as the cryptographic key.

The payloads delivered through DOUBLECUP include CountLoader and DeviceManager. The Windows version of CountLoader is designed to persist on systems by creating scheduled tasks, while its macOS variant uses AppleScript to achieve persistence.