DOUBLECUP loader service stages malware in the browser cache to drop a RAT on Windows and macOS

ClickFix stopped being a clever trick this summer and turned into a product. A Russian crew now rents out a full delivery service called DOUBLECUP, and the interesting part is not the lure, it is where the malware waits. The payload never crosses the network as a program. It arrives as an ordinary image, sits in the browser cache, and gets rebuilt on the machine by tools that ship with Windows. That one design choice moves the whole detection problem off the wire and onto the host.

SOCRadar's Threat Research Unit found the service after it turned up an open directory holding the operation's test files and a licensing panel, and dates it to early June 2026. DOUBLECUP sells access the way a normal software vendor would, through a Telegram bot, and ships two payloads: a loader called CountLoader and a remote-access trojan, new to researchers, that its authors named DeviceManager. Both run on Windows, and CountLoader has a macOS build covering Intel and Apple Silicon.

Why the browser cache is the whole trick

The lure is a fake CAPTCHA on a spoofed login page for a business platform: NetSuite, Odoo, HubSpot, or Salesforce. When the victim lands on the page, an embedded frame quietly pulls a PNG that the browser caches like any other image. The fake verification screen then walks the victim into pasting a command that was slipped onto their clipboard.

Here is the part that matters for defenders. That pasted command does not download anything. It scans the browser cache for the image by its exact file size, carves the hidden first stage out of it, and runs it with utilities that are already on the box, such as certutil and findstr. The malicious bytes were on disk before the command ever ran, delivered earlier as a harmless-looking picture. So a web proxy sees an image request, endpoint download logging sees an image, and the executable everyone is watching for never appears. We flagged this browser-resident assembly move when SourTrade built its malware inside the browser. DOUBLECUP is the industrialized version of it.

The payload will not detonate in your sandbox

Before the final stage decrypts, the dropper reads the machine's public IPv4 address and folds it into the key. Decryption only succeeds on the host that was actually hit. Run the same sample in an analysis box on a datacenter address and it derives the wrong key and does nothing. That is a deliberate answer to automated detonation: a sandbox that judges a file by what it does when executed will mark this one inert and move on. If your triage leans on sandbox verdicts, these samples pass with a clean bill of health. Host behavior beats file verdicts here.

Blocking the C2 address barely helps

DeviceManager is a Python trojan that does not carry its command-server address in the clear. It reads that address from a blockchain smart contract, a method researchers call EtherHiding, and it can fall back to DNS for its traffic. The operator rotates infrastructure by writing a new value on-chain, so a blocklist entry for today's server is stale tomorrow. The durable signal is not the address, it is the lookup: a non-wallet process on a server reaching out to a public blockchain node has almost no honest reason to do so.

What survives after you clean the box

CountLoader does the expected reconnaissance, profiling the host, checking for cryptocurrency wallet extensions, and looking for Signal Desktop. One behavior earns its own line on the incident-response checklist: it rewrites the targets of browser shortcuts. Remove the trojan, miss the poisoned shortcut, and the next time the user clicks their browser icon they relaunch the loader. Cleaning the payload without auditing shortcut targets (MITRE ATT&CK T1547.009) leaves a quiet, user-triggered path straight back in. The macOS build pursues the same reconnaissance and persistence goals with Mac-native methods, which kills the assumption that ClickFix is a Windows-only problem. We watched the same lure pushed at Mac users earlier this summer.

What to detect this week

Patching does not apply here. There is no vulnerability, only a workflow that ends with a person running a command. So the work is detection and user friction. Concrete places to look:

• The paste-to-run chain. A shell or scripting host launched seconds after a clipboard action, with a browser as the ancestor process, is the ClickFix signature. We broke this pattern down in our ClickFix detection guide, and it catches DOUBLECUP the same way it catches the stealer campaigns built on the technique.
• System tools reading the browser cache. certutil or findstr touching a browser cache directory is near zero in normal use. Alert on it.
• On-chain and DNS callbacks. Server processes querying public blockchain endpoints, or unusual volumes of name-resolution traffic from a workload that should barely resolve anything, point at DeviceManager talking to its operator.
• Shortcut integrity. Put browser shortcut targets in the persistence hunt, not just run keys and scheduled tasks.

The wider lesson is about ClickFix itself. We have covered it as a delivery technique several times this year, and DOUBLECUP is the point where it became a rented service with a support channel and a price tag. The technique is not going to get rarer. The counter is what it has always been: no legitimate site verifies that you are human by asking you to paste a command into a system dialog. That single rule, taught and enforced, breaks the entire chain before any of the clever cache work matters.