DOUBLECUP: the new Russian malware service that hides code inside cached images

Key points

• Researchers have identified a new Russian-speaking malware service called DOUBLECUP that rents out attack tools to other criminals.
• The service uses ClickFix, a trick that fools people into pasting a malicious command into Windows, to start the infection.
• Malware is hidden inside PNG image files that the victim's own web browser has already downloaded and cached.
• The final payloads include CountLoader, which runs on Windows and macOS, and a new Windows remote access tool called DeviceManager.
• Early campaigns have targeted Russian-speaking users, but the toolkit is being sold to anyone who can pay.

A new criminal service out of the Russian-speaking underground is quietly rewriting how everyday malware gets onto everyday computers. It is called DOUBLECUP, and it rents its tricks by the month.

DOUBLECUP is what the industry calls a loader-as-a-service. In plain English: the operators build and maintain the tools that sneak malicious software onto a victim's machine, then sell access to other crooks who bring their own payloads. Think of it as the delivery van for the wider cybercrime economy.

The service was first reported by BleepingComputer and is now being tracked by several incident-response teams. Its customers appear to be smaller crews who want a reliable way in, without building one themselves.

How does the attack actually start?

It starts with a technique called ClickFix, where a fake error page or captcha tells the visitor to "fix" a problem by copying a line of text and pasting it into a Windows dialog box. The line looks harmless. It is not.

Once pasted, the command quietly runs on the victim's PC and reaches out for the next stage.

The clever part is where the next stage lives. Instead of downloading fresh malware from a suspicious server, DOUBLECUP pulls it out of PNG image files that the browser has already saved to its cache, the temporary storage every browser keeps to make websites load faster. To a security tool watching network traffic, nothing new is being downloaded. The dangerous code is already sitting on the disk, dressed up as a picture.

What gets installed at the end?

Two things, depending on the victim's operating system. On Windows and macOS, DOUBLECUP drops CountLoader, a known piece of malware whose job is to fetch and run whatever the paying customer wants next. That often means banking trojans, information stealers or ransomware crews looking for a foothold.

On Windows specifically, researchers also found a brand-new remote access trojan, or RAT, called DeviceManager. A RAT is exactly what it sounds like: it lets the attacker sit at your keyboard from anywhere in the world, read your files, watch your screen and type commands.

Who is being targeted?

Early campaigns have leaned on Russian-language lures, suggesting the first wave of customers is aiming at Russian-speaking users and businesses. That rarely stays true for long. Loader services usually spread outward as more affiliates sign up, and the ClickFix trick works in any language you care to translate it into.

No ransom demands or named victims have surfaced yet. This is a plumbing story, not a breach story. But the plumbing feeds ransomware gangs, and that is where it will end up being felt.

What should ordinary users do?

Be suspicious of any web page that asks you to press Windows+R, or to open a Run box, or to paste something into PowerShell or Terminal to "verify" you are human or to "fix" a display error. No real website ever needs you to do that. If a captcha gives you copy-paste instructions, close the tab.

Keep your browser and operating system up to date, and if you manage a company fleet, restrict who can run PowerShell and script hosts from a standing start. That single control breaks most ClickFix chains cold.