DOUBLECUP: the new Russian malware service that hides code inside cached images

Key points

• Researchers have identified a new Russian-speaking malware service called DOUBLECUP that rents out attack tools to other criminals.
• The service uses ClickFix, a trick that fools people into pasting a malicious command into Windows, to start the infection.
• Malware is hidden inside PNG image files that the victim's own web browser has already downloaded and cached.
• The final payloads include CountLoader, which runs on Windows and macOS, and a new Windows remote access tool called DeviceManager.
• Early campaigns have targeted Russian-speaking users, but the toolkit is being sold to anyone who can pay.

A new criminal service out of the Russian-speaking underground is quietly rewriting how everyday malware reaches everyday computers. It's called DOUBLECUP, and it rents its tricks by the month.

DOUBLECUP is what the industry calls a loader-as-a-service: the operators build and maintain the tools that sneak malicious software onto a victim's machine, then sell access to other crooks who bring their own payloads. It's the delivery van for the wider cybercrime economy. Threat Vectr first picked up the ClickFix-style approach on 16 July, when we reported on TELEPUZ spreading through booby-trapped sites that tricked visitors into pasting malicious commands. DOUBLECUP takes that same social-engineering logic and wraps a commercial service around it.

How does the attack actually start?

It starts with ClickFix, a technique where a fake error page or captcha tells the visitor to "fix" a problem by copying a line of text and pasting it into a Windows dialog box. The line looks harmless. It isn't.

Once pasted, the command runs on the victim's PC and reaches out for the next stage. That next stage is where DOUBLECUP gets interesting. Instead of pulling fresh malware from a suspicious server, it extracts malicious code from PNG image files the browser has already saved to its cache, the temporary storage every browser keeps to make websites load faster. To a security tool watching network traffic, nothing new is being downloaded. The dangerous code is already on the disk, dressed as a picture.

What gets installed at the end?

Two payloads, depending on the operating system. On Windows and macOS, DOUBLECUP drops CountLoader, a piece of malware whose job is to fetch and run whatever the paying customer wants next. That typically means banking trojans or ransomware crews looking for a foothold.

On Windows specifically, researchers also found a brand-new remote access trojan, or RAT, called DeviceManager. A RAT lets the attacker operate your machine from anywhere: reading files, watching the screen, running commands.

Who is being targeted?

Early campaigns have leaned on Russian-language lures, suggesting the first customers are aiming at Russian-speaking users and businesses. That rarely stays true for long. Loader services spread outward as more affiliates sign up, and ClickFix works in any language you translate it into.

No ransom demands or named victims have surfaced yet. This is a plumbing story, not a breach story. But the plumbing feeds ransomware gangs, and that's where it'll be felt.

What should ordinary users do?

Be suspicious of any web page that asks you to press Windows+R, open a Run box, or paste something into PowerShell to "verify" you're human or "fix" a display error. No real website needs you to do that. If a captcha gives you copy-paste instructions, close the tab.

Keep your browser and operating system current. If you manage a company fleet, restrict who can run PowerShell and script hosts from standing. That single control breaks most ClickFix chains cold.