Back Feeds.4Sysops

DOUBLECUP turns ClickFix into cached PNG delivery for CountLoader and DeviceManager

Feeds.4Sysops •IT News • August 4, 2026

DOUBLECUP is using fake CRM pages and ClickFix instructions to hide malware inside PNG files cached by browsers. The loader delivers CountLoader or the newly documented DeviceManager RAT, which decrypts payloads in memory and can use blockchain-resolved command-and-control infrastructure. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DOUBLECUP Service Delivers Malware via Cached PNG Images The DOUBLECUP loader-as-a-service, identified by SOCRadar, employs ClickFix attacks to conceal malware within PNG images cached by browsers. This service, operational since June 2026, targets Windows and macOS systems, delivering CountLoader and a new remote access trojan (RAT) named DeviceManager. Attackers use fake CAPTCHA prompts on legitimate-looking CRM pages to trick users into executing malicious commands. The method involves embedding malicious code in steganographic images, which are downloaded and executed from the browser cache. DOUBLECUP provides a Go-based tool for customers to configure and launch these campaigns, managing the necessary infrastructure for attacks. SOCRadar's investigation revealed the service's licensing panel hosted on a specific IP address, indicating organized operations. The impact is significant, affecting enterprise users of popular CRM platforms. 3 sources 67

Extracted Entities

DOUBLECUP turns ClickFix into cached PNG delivery for CountLoader and DeviceManager

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (3)