Malware News SOCRadar Researchers uncover DOUBLECUP, a ClickFix loader using steganography and IP-based environmental keying to deliver CountLoader & DeviceManager

[Khushal]

Content source

https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/

https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/

SOCRadar’s Threat Research Unit (STRU) identified and analyzed DOUBLECUP, a Russian Loader-as-a-Service (LaaS) for ClickFix campaigns. Operating in a client-server architecture, each client can configure campaigns that host the DOUBLECUP logic on specific URLs.

The DOUBLECUP panel provides multiple utilities to load an operator’s final payload. The first stage drops a steganographic PNG image into the browser’s cache, retrieves its hidden content, and executes the second stage. This second stage decrypts the final payload in memory via a custom SHA-256 stream cipher in Counter (CTR) mode along with bitwise XOR using the victim’s public IP address as the cryptographic key. Identified payloads loaded by DOUBLECUP include an updated version of CountLoader (with variants for both Windows and macOS) and DeviceManager, a new Remote Access Trojan (RAT) that utilizes EtherHiding to resolve its C2 infrastructure and communicate via HTTP or DNS tunneling.

 

[Bot]

Key security takeaways

The described DOUBLECUP activity combines several techniques to make ClickFix infections more difficult to detect:

• Social engineering persuades the victim to paste or execute a command, rather than exploiting a software vulnerability directly.
• A PNG file is used to conceal a second-stage payload through steganography.
• The final payload is decrypted in memory, which may reduce the usefulness of simple file-based detection.
• EtherHiding can conceal command-and-control information in blockchain-related data or other publicly accessible content.
• The reported payloads include Windows and macOS variants, so this is not limited to one operating system.

Users should never paste commands into PowerShell, Terminal, Command Prompt, or the Run dialog merely because a website instructs them to “verify” something, fix a browser issue, or complete a CAPTCHA. Legitimate CAPTCHA systems do not require executing arbitrary commands.

If a command was already executed

• Disconnect the affected device from the network if active compromise is suspected.
• Do not log in to sensitive accounts from that device.
• Run a full scan using reputable, up-to-date security software.
• Review browser extensions, startup items, scheduled tasks, recently created files, and unusual outbound connections.
• Change important passwords from a separate, trusted device and enable multifactor authentication where available.
• Preserve relevant commands, URLs, downloaded files, and security logs for analysis.
• Submit suspicious files or URLs to VirusTotal, while avoiding the upload of confidential documents or private data.

A specific file or URL cannot be declared safe or malicious from this excerpt alone. Detailed indicators and additional analysis should be checked against the original SOCRadar report and current detections from reputable security vendors.