DOUBLECUP: ClickFix Loader-as-a-Service Restoring Fileless Payload from PNG in Browser...
DOUBLECUP: ClickFix Loader-as-a-Service Restoring Fileless Payload from PNG in Browser Cache
1. Basic Information
Article Title: New DOUBLECUP ClickFix service hides malware in browser cache images
Source: BleepingComputer
Publication Date: August 3, 2026
New DOUBLECUP ClickFix service hides malware in browser cache images
DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm
DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims'…
DOUBLECUP hides malware stages in cached PNG files, then uses ClickFix commands to deliver CountLoader variants and the…
ClickFix attacks are delivering BabaDeda, Lorem Ipsum, and Potemkin loaders to deploy stealers, RATs, and ransomware-linked…
Researcher analyzed 3,000 ClickFix payloads and found rotating wrappers plus a Downloads-folder method built to bypass AMSI.
A macOS ClickFix campaign uses more than 250 domains and server-side fingerprinting to hide AMOS lures from crawlers and serve…
DoubleClick redirects hide DesckVB RAT malspam, using dynamic lures and .NET loaders to evade detection and control hosts.
