Executive Summary
A SOCRadar Threat Research Unit report published on 3 August 2026 detailed DOUBLECUP, a Russian Loader-as-a-Service designed to support ClickFix campaigns. The service enables operators to configure malicious lure pages that instruct victims to copy and execute commands from fake verification prompts. DOUBLECUP retrieves hidden code from a steganographic PNG cached by the victim’s browser and decrypts its final payload directly in memory using the victim’s public IP address as part of the cryptographic key.
SOCRadar observed DOUBLECUP delivering an updated version of CountLoader targeting Windows and macOS, as well as a previously undocumented Windows remote access trojan named DeviceManager. The malware provides operators with persistence, system reconnaissance, command execution, payload delivery, and resilient command and control capabilities.
Key Takeaways
- DOUBLECUP is a Russian Loader-as-a-Service developed for ClickFix campaigns and has operated since early June 2026.
- The service provides operators with licenses and a client application for creating campaigns, configuring lure pages, selecting payload delivery methods, and managing campaign activity.
- Observed campaigns impersonated login pages for major CRM platforms, including NetSuite, Odoo, HubSpot, and Salesforce.
- DOUBLECUP displays fake verification instructions and copies a browser-specific command to the victim’s clipboard for manual execution.
- The infection chain forces the victim’s browser to cache a steganographic PNG image containing hidden code. The copied command searches the browser cache, extracts the embedded code, and executes the first-stage payload.
- The second stage operates as an obfuscated, fileless dropper that uses the victim’s public IP address to derive a cryptographic key and decrypt the final payload in memory.
- Using the victim’s IP address as an environmental key can prevent the payload from decrypting correctly in offline sandboxes or networks other than the intended target environment.
- DOUBLECUP was observed delivering CountLoader version 4.5p for Windows and macOS and a previously undocumented Windows RAT named DeviceManager.
- CountLoader establishes persistence through scheduled tasks and can copy, rename, and modify the PE metadata of legitimate Windows utilities, including conhost.exe, powershell.exe, and mshta.exe, to execute commands while masquerading as trusted applications.
- CountLoader profiles infected systems for operating-system information, antivirus products, domain membership, Signal Desktop, cryptocurrency wallets, and targeted browser extensions.
- DeviceManager is a modular Python-based RAT delivered through an Inno Setup installer and configured to execute through an embedded Python environment without displaying a console window.
- SOCRadar linked the Telegram bot used for DOUBLECUP operational notifications to the threat actor Rognar, operating under the Telegram username @johnysilverhe.
Mitigation Options
The F4N6 security research team has provided the following mitigations:
- Block the known infrastructure: Add 213.139.77[.]109 to firewall, proxy, and EDR blocklists. Monitor for any outbound connections to this IP on port 9090 or any port.
- Block the Telegram bot handle: Add @harrypoterlohBOT to allowed/denied lists in any corporate Telegram or messaging monitoring controls. Monitor for this handle in endpoint messaging telemetry if feasible.
- Audit for the VS Code extension: Search endpoint management telemetry for the extension name Agent IDE by publisher “johnnysilverhe.” If found on any developer workstation, quarantine the machine, preserve the extension for forensic review, and revoke any credentials accessed from that machine. Note: the source flags this extension as suspicious but does not confirm malicious behaviour – treat as precautionary.
- Hunt for ClickFix TTPs: Search web proxy logs and DNS logs for requests matching the pattern https://{domain}/{slug}/api/config – specifically any /api/config endpoint on domains impersonating CRM platforms (NetSuite, Odoo, HubSpot, Salesforce). Flag any hits for incident response.
- DNS tunneling detection: Enable or verify DNS tunneling detection on recursive resolvers and DNS firewalling. DeviceManager uses DNS tunneling for C2 – look for high-volume TXT or NULL record queries to a single domain, unusually long subdomain labels, or high-entropy DNS query patterns.
- Browser cache monitoring: Develop detection for PowerShell, VBScript, or JavaScript execution originating from browser cache directories (e.g., %LOCALAPPDATA%\Google\Chrome\User Data\Default\Cache\, equivalent paths for Edge, Firefox, Brave, Opera). This is the extraction point for the steganographic PNG payload.
- Clipboard-injection-to-execution detection: Deploy or tune EDR rules for the ClickFix pattern: a browser process writing to the clipboard followed by powershell[.]exe, cscript[.]exe, wscript[.]exe, or cmd[.]exe executing clipboard content shortly after. The clipboard content will contain a command that searches the browser cache.
- Steganographic PNG detection: Evaluate endpoint DLP or EDR capabilities for scanning PNG files in browser cache for embedded data. The source does not specify the steganography method used, so generic steganography-detection tooling should be evaluated.
- CRM impersonation blocking: Add the observed impersonated CRM domains to DNS blocklists or web proxy deny categories. Validate that legitimate CRM access is through SSO or known-good URLs, and alert on any credential entry to CRM-looking pages outside the corporate SSO flow.
- User awareness: Brief staff – particularly sales, marketing, and finance functions who use CRM platforms – on the ClickFix social-engineering pattern: a webpage displaying a fake “verification” or “captcha” prompt that instructs the user to press Win+R, paste a command, and execute it. This is the human-execution step that makes the attack chain work.
- macOS endpoint coverage: CountLoader has a macOS variant. Verify that macOS endpoints in the estate have equivalent EDR coverage and that browser cache monitoring rules apply to macOS browser cache paths.
- Threat-intel feed update: Ensure the DOUBLECUP IOCs and TTPs are added to the organisation’s threat-intel platform and that SIEM detection rules reference the behavioural patterns described above.
MITRE ATT&CK TTPs
SOC Radar security research team has provided a list of TTPs that can be tracked using the MIRE ATT&CK framework found here.
IOCs
SOC Radar security research team has provided a list of indicators of compromises (IOCs) that can be found here.
