Listen to this Post
Introduction: A Dangerous Evolution in Modern Cybercrime
Cybercriminal operations continue to evolve at an alarming pace, combining social engineering with advanced malware delivery techniques that make traditional security defenses increasingly ineffective. Security researchers have now uncovered DOUBLECUP, a sophisticated Russian Loader-as-a-Service (LaaS) platform that demonstrates how professional cybercriminal groups are transforming malware distribution into a commercial ecosystem.
Unlike conventional malware loaders, DOUBLECUP introduces multiple layers of stealth by hiding malicious code inside seemingly harmless PNG images, leveraging browser caches as temporary storage, and encrypting payloads using victim-specific cryptographic keys. Even more concerning, the platform supports both Windows and macOS, making it a cross-platform threat capable of targeting a much broader audience.
The discovery highlights not only the technical sophistication of modern malware operations but also how organized cybercrime increasingly resembles legitimate software development, complete with licensing systems, client management panels, automated campaign builders, and technical support for affiliates.
Summary: What Security Researchers Discovered
Security researchers from SOCRadar uncovered a previously undocumented malware distribution platform known as DOUBLECUP, operating since early June 2026.
Rather than simply delivering malware directly, DOUBLECUP functions as a Loader-as-a-Service platform that allows cybercriminal operators to purchase licenses, build customized campaigns, and distribute malicious payloads using ClickFix social engineering attacks.
Its infection chain begins by convincing victims to execute browser-specific commands through fake troubleshooting instructions. Once executed, the malware retrieves a specially crafted PNG image hidden inside the victim’s browser cache.
However, this image is far from ordinary.
Embedded within it is hidden malicious code using steganography. After extraction, the malware decrypts an additional payload directly in memory using a custom encryption algorithm that combines SHA-256 Counter Mode with XOR encryption generated from the victim’s own public IP address.
This means the payload is mathematically locked to the intended victim.
Even if researchers intercept the malware during transmission, decryption will fail on any other machine because the encryption key depends entirely on the victim’s public IPv4 address.
The result is an infection chain specifically engineered to frustrate malware analysts and automated security tools.
DOUBLECUP: Malware-as-a-Service Becomes Professional
DOUBLECUP is far more than a malware loader.
Researchers discovered an entire commercial platform supporting cybercriminal customers through licensing systems, configuration management, campaign deployment, and payload builders.
Each customer receives:
Unique license keys
Campaign management tools
Client software
Configuration updates
Broadcast command systems
Automated payload deployment
The infrastructure closely resembles legitimate SaaS software.
Operators simply configure domains, upload payloads, generate ClickFix pages, and launch campaigns against victims.
Multiple attack campaigns can operate simultaneously under a single license.
ClickFix Continues Expanding Across the Threat Landscape
ClickFix has rapidly become one of the most abused social engineering techniques in modern cyberattacks.
Instead of exploiting software vulnerabilities directly, attackers manipulate victims into executing malicious commands themselves.
DOUBLECUP automates this process.
Victims visit fake login pages impersonating trusted enterprise platforms including:
NetSuite
Odoo
HubSpot
Salesforce
Embedded iframes load malicious JavaScript that detects the victim’s browser before displaying convincing fake troubleshooting instructions.
The instructions copy browser-specific commands directly into the user’s clipboard.
Once executed, those commands silently begin the infection process.
Steganography Hides Malware in Plain Sight
Perhaps the most impressive technical component of DOUBLECUP is its use of image steganography.
Rather than downloading obvious executable files, the malware retrieves ordinary-looking PNG images.
Inside those images is hidden JavaScript, PowerShell, or VBScript code.
Because security products often treat image files as harmless content, the malware gains an additional layer of stealth.
The browser cache effectively becomes temporary malware storage without triggering many conventional detection mechanisms.
Environmental Encryption Makes Analysis Extremely Difficult
DOUBLECUP introduces another sophisticated defensive technique.
Instead of shipping a universal encryption key, it generates one using the victim’s own public IP address.
That address becomes the seed for cryptographic key generation.
As a result:
Analysts cannot simply copy the malware to another computer.
Sandboxes fail to decrypt the payload correctly.
Security researchers receive unusable encrypted binaries.
Reverse engineering becomes significantly more difficult.
This environmental keying represents another growing trend among advanced malware developers.
CountLoader Receives Major Capability Improvements
One payload distributed through DOUBLECUP is an updated version of CountLoader.
The malware now includes several new capabilities designed for persistence, reconnaissance, and credential theft.
Among its functions are:
Scheduled task persistence
Browser extension auditing
Cryptocurrency wallet discovery
Signal Desktop detection
Browser shortcut modification
Remote payload execution
Archive downloading
DLL deployment
HTA execution
Evidence cleanup
Researchers also identified unfinished code capable of hijacking browser shortcuts.
Although currently inactive, it demonstrates ongoing development and future expansion plans.
Cross-Platform Malware Targets Windows and macOS
Unlike many traditional malware families that focus solely on Windows, CountLoader now includes a dedicated macOS implementation.
While adapting persistence methods for
This reflects the growing interest among threat actors in targeting macOS environments as Apple devices continue gaining popularity within enterprise networks.
DeviceManager Introduces Blockchain-Based Command Infrastructure
The second malware family distributed through DOUBLECUP is an entirely new Remote Access Trojan known as DeviceManager.
Written in Python and packaged inside a Delphi-based installer, DeviceManager includes a complete embedded Python runtime.
Instead of hardcoding command-and-control servers, it retrieves active server information through Ethereum and Polygon smart contracts.
This technique, commonly known as EtherHiding, stores infrastructure information on public blockchains.
Because blockchain records cannot easily be removed, attackers gain a resilient mechanism for recovering updated command servers even if previous infrastructure is taken offline.
Regional Safeguards Reveal Threat Actor Origins
DeviceManager includes an interesting operational security feature.
Before installation proceeds, the malware checks the
If it detects languages associated with Commonwealth of Independent States (CIS) countries, it immediately:
Removes scheduled tasks
Deletes installation files
Executes self-removal
Terminates execution
This behavior has become increasingly common among malware originating from Russian-speaking cybercriminal ecosystems.
Telegram Plays a Central Role
Researchers also discovered that operators manage portions of DOUBLECUP using a Telegram bot.
The bot performs numerous operational functions including:
Visitor notifications
Command distribution
License key management
Payload callbacks
Campaign monitoring
The bot has reportedly been associated with an individual using the alias johnnysilverhe, who has also published a suspicious Visual Studio Code extension named Agent IDE.
Why DOUBLECUP Represents a Significant Threat
DOUBLECUP combines multiple advanced technologies rarely observed together in a single malware ecosystem.
Instead of relying on one stealth technique, it layers numerous evasion methods simultaneously.
These include:
Browser cache abuse
ClickFix social engineering
Image steganography
Victim-specific encryption
Blockchain-based C2 discovery
DNS tunneling
HTTP fallback communication
Cross-platform malware support
Professional campaign management
Automated licensing infrastructure
Collectively, these features significantly complicate both malware detection and incident response.
What Undercode Say:
DOUBLECUP demonstrates how cybercrime is increasingly operating as a professional software business rather than isolated hacking campaigns.
The Loader-as-a-Service model lowers the barrier for less technically skilled attackers, allowing affiliates to deploy advanced malware using polished management tools instead of writing their own code.
The combination of ClickFix with browser cache abuse is particularly concerning because it shifts the attack focus from exploiting software flaws to exploiting human behavior. Even fully patched systems remain vulnerable if users are convinced to execute malicious commands.
Steganography continues to be an effective evasion technique because many organizations prioritize scanning executable files while treating image assets as low risk. Security teams should consider inspecting media files delivered from untrusted sources, especially when paired with suspicious browser activity.
Environmental keying using a
The integration of Ethereum and Polygon smart contracts through EtherHiding reflects a broader trend toward decentralized command infrastructure. Public blockchains provide attackers with resilient, difficult-to-disable locations for storing command-and-control information, reducing their dependence on traditional servers.
The appearance of both Windows and macOS payloads shows that attackers are investing more heavily in cross-platform operations. Organizations that assume Apple devices face lower malware risks should reconsider that assumption and apply equivalent monitoring and endpoint protection across all operating systems.
The discovery of a licensing system, campaign builder, and operator dashboard suggests that cybercriminal ecosystems are becoming increasingly organized. These services mirror legitimate software businesses, offering scalability, automation, and customer support to affiliates.
Defenders should strengthen user awareness training around ClickFix-style lures, restrict unnecessary PowerShell usage, monitor browser cache anomalies, and inspect outbound DNS and HTTP traffic for unusual patterns. Security controls that correlate user actions with endpoint telemetry will become increasingly important as social engineering campaigns continue to evolve.
Example Defensive Investigation Commands (Linux)
Search suspicious PowerShell references grep -Ri "powershell" /var/log/
Identify outbound DNS connections
sudo tcpdump -i any port 53
Monitor HTTP sessions
sudo tcpdump -i any port 80
Detect unusual scheduled task artifacts (Windows forensic shares)
find /mnt/windows -iname ".job"
Scan PNG files for hidden embedded content
binwalk suspicious.png
Extract readable strings
strings suspicious.bin
Calculate SHA-256 hash
sha256sum suspicious.bin
Search for Indicators of Compromise
grep -Ri "91.92.240.100" /var/log/
Review active network connections
ss -tulpn
Inspect suspicious processes
ps auxf
✅ Security researchers have documented DOUBLECUP as a Loader-as-a-Service platform that uses ClickFix lures, steganographic PNG files, and multi-stage malware delivery, matching the technical findings presented.
✅ The reported use of CountLoader, the newly documented DeviceManager RAT, environmental keying based on the victim’s public IP address, and EtherHiding through Ethereum/Polygon smart contracts is consistent with the published technical analysis.
❌ There is no public evidence that DOUBLECUP has achieved widespread global compromise across all industries or that every observed capability has been deployed in every campaign. Some features, such as inactive browser shortcut hijacking code, appear to be under development rather than actively used.
Prediction
(+1) The discovery of DOUBLECUP is likely to accelerate improvements in endpoint detection focused on browser cache abuse, steganography analysis, and ClickFix-style social engineering campaigns.
Security vendors will increasingly monitor browser cache activity alongside traditional executable scanning.
More organizations will introduce stricter controls around PowerShell, scripting engines, and clipboard-based attack techniques.
Threat actors will continue adopting decentralized infrastructure such as blockchain-based command resolution to improve resilience against takedowns.
Cross-platform malware targeting Windows and macOS will become more common as enterprise environments grow increasingly diverse.
Future Loader-as-a-Service platforms are expected to incorporate even more automation, encryption, and anti-analysis mechanisms, making proactive threat hunting more critical than ever.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
