VTA-000196 – New DOUBLECUP Loader – as – a – Service Uses ClickFix, Steganography, and Environmental Keying to Deliver Malware

Researchers have identified a new Russian-based Loader-as-a-Service (LaaS) known as DOUBLECUP, which uses ClickFix social engineering to deploy malware on both Windows and macOS systems. The attack begins by convincing victims to execute copied commands through fake login pages impersonating popular business platforms.

Once executed, the first stage downloads a steganographic PNG image into the victim's browser cache. Hidden data extracted from the image launches the second stage, which decrypts the final payload entirely in memory using environmental keying. The malware derives its decryption key from the victim's public IP address, making the payload difficult to analyze or execute outside the intended target.

The service has been observed delivering CountLoader and a previously undocumented DeviceManager remote access trojan. CountLoader establishes persistence, collects system information, downloads additional payloads, and can execute various file types. DeviceManager is a modular Python-based RAT that resolves its command-and-control (C2) infrastructure through Ethereum and Polygon smart contracts using the EtherHiding technique before communicating over HTTP or DNS tunneling.

Researchers also found that the malware operators provide a management panel, payload builder, and licensing system that enables threat actors to easily create customized ClickFix campaigns. The combination of browser cache abuse, steganography, in-memory decryption, environmental keying, and blockchain-based C2 resolution significantly increases the malware's ability to evade traditional detection and analysis while maintaining resilient command-and-control communications.

Severity:

Medium

Attack Surface:

Endpoint, Web Browser, Email, Endpoint OS, Web Application, Infrastructure

Tactics:

Initial Access, Execution, Defense Evasion, Command and Control, Persistence

Techniques:

T1204 – User Execution

T1027 – Obfuscated Files or Information

T1027.003 – Steganography

T1566 – Phishing

T1105 – Ingress Tool Transfer

T1071 – Application Layer Protocol

T1547 – Boot or Logon Autostart Execution

References:

1. https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/

SuperPRO’s Threat Countermeasures Procedures:

1. Educate users to avoid executing PowerShell, Command Prompt, or terminal commands copied from websites or unexpected prompts.

2. Block or restrict PowerShell, Windows Script Host (WSH), VBScript, and HTA execution where not required.

3. Monitor browser cache activity and detect abnormal access to cached files, especially PNG images followed by script execution.

4. Deploy Endpoint Detection and Response (EDR) solutions capable of detecting in-memory payload execution, process injection, and LOLBin abuse.

5. Monitor outbound HTTP and DNS traffic for suspicious communications, including DNS tunneling and connections to newly observed or low-reputation domains.

6. Inspect network traffic for blockchain-based C2 resolution techniques, including unusual connections to Ethereum or Polygon infrastructure from endpoints.

7. Implement application allowlisting to prevent unauthorized executables, scripts, and installers from running.

8. Enable multi-factor authentication (MFA) to reduce the impact of credential theft through fake login pages.

9. Keep operating systems, browsers, and security solutions updated with the latest security patches and threat intelligence.

Contributed by: Fatini