DOUBLECUP: ClickFix + hidden PNGs to deliver CountLoader and DeviceManager RAT

A new malicious campaign dubbed DOUBLECUP exploits the ClickFix technique and cached PNGs to distribute two malware families: CountLoader and DeviceManager RAT. Anatomy of a two-stage attack.

What

The Hacker News reports an active campaign dubbed DOUBLECUP — a new Russian-origin loader-as-a-service (LaaS) — that combines two techniques to deploy its payload: ClickFix (a "copy-paste this command to fix the issue" social engineering tactic) and PNG files cached in the browser to conceal and deliver the payload.

The ultimate goal: install two distinct malware families, CountLoader and DeviceManager RAT (a previously undocumented Remote Access Trojan).

How it works

DOUBLECUP operates in two distinct stages — hence the name:

1. ClickFix — the social hook + caching The victim lands on a malicious page that prompts them to "fix a problem" by copying and pasting a command into their terminal or PowerShell. But this ClickFix lure also ensures that malicious PNGs are cached in the victim’s browser — transparently, without any further action. These PNGs carry the payload via steganography (payload hidden within image data).

2. Execution chain The ClickFix command executes the first component, which leverages the cached PNGs to deploy CountLoader. CountLoader then loads DeviceManager RAT, providing full remote access to the compromised machine.

Who is impacted

Anyone likely to run "troubleshooting" commands found on a web page or received via a message. Classic ClickFix targets: Windows users, developers, IT technicians — profiles comfortable with the terminal and thus more likely to let their guard down.

What to do

• Never execute a command copied from a web page without fully understanding it
• Train tech teams: ClickFix specifically targets people at ease with the terminal
• Review EDR/AV rules to detect PNG loading followed by code execution behavior

Action now: Block unsigned PowerShell script execution (Set-ExecutionPolicy RemoteSigned). And train teams to recognize ClickFix — the best defense against social engineering is knowledge of the attack.