DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

Back Thehackernews

DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

Thehackernews •[email protected] (The Hacker News) • August 4, 2026

Share: View original

Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DOUBLECUP Service Delivers Malware via Cached PNG Images The DOUBLECUP loader-as-a-service, identified by SOCRadar, employs ClickFix attacks to conceal malware within PNG images cached by browsers. This service, operational since June 2026, targets Windows and macOS systems, delivering CountLoader and a new remote access trojan (RAT) named DeviceManager. Attackers use fake CAPTCHA prompts on legitimate-looking CRM pages to trick users into executing malicious commands. The method involves embedding malicious code in steganographic images, which are downloaded and executed from the browser cache. DOUBLECUP provides a Go-based tool for customers to configure and launch these campaigns, managing the necessary infrastructure for attacks. SOCRadar's investigation revealed the service's licensing panel hosted on a specific IP address, indicating organized operations. The impact is significant, affecting enterprise users of popular CRM platforms. 3 sources 67

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (3)

ClickFix CountLoader DeviceManager RAT