DEV Community

Anoymask
Anoymask

Posted on

DOUBLECUP: ClickFix Loader-as-a-Service Restoring Fileless Payload from PNG in Browser Cache

#security #threatintel

DOUBLECUP: ClickFix Loader-as-a-Service Restoring Fileless Payload from PNG in Browser Cache

1. Basic Information

2. Summary

A Russian Loader-as-a-Service uses fake CAPTCHAs to put commands into the clipboard. It tricks users into running them. The commands extract a stage from a browser cache PNG. They decrypt the final payload using a key from the public IP and run it in memory.

3. Attack Flow

Delivery/Loader Chain

  1. Operators make fake sites that look like NetSuite, Odoo, HubSpot, or Salesforce. They add DOUBLECUP iframes and frontends.
  2. The site gets browser commands, image URLs, image sizes, and session endpoints from /api/config. It registers a 16-character session ID.
  3. The site downloads /stego-image.png?sid=... in the background. It saves the image to the browser cache and gets the public IP.
  4. A fake CAPTCHA copies a command automatically. It tricks the user into pressing Win+R or opening a terminal, pasting the command, and running it.
  5. The command searches the cache using the exact file size. It uses findstr or certutil to extract and run the stage inside the PNG.
  6. A fileless dropper decrypts the final payload. It uses the public IPv4 address as key material with custom SHA-256 CTR/XOR. It checks a hardcoded SHA-256 hash and runs the payload in memory.

Payload Chain

  • CountLoader: Counts system files, crypto wallets, browser extensions, and Signal. It sets up persistence using Scheduled Tasks (Windows) or LaunchAgents (macOS). It runs extra MSI, PowerShell, or DLL files.
  • DeviceManager: Sets up persistence using Scheduled Tasks or WMI Event Subscriptions. It finds its C2 server using Ethereum or Polygon smart contracts. It handles commands, downloads, and data theft using HTTP or DNS A/TXT records.

4. Attacker Roles and Execution Locations

  • LaaS developers run license panels, stego hosting, sessions, keys, and auto-rebuild features.
  • Customers and operators run fake sites and templates.
  • Browsers cache the stage. Endpoints (Windows/macOS) run it after the user operates the Run dialog or terminal.
  • C2 locators use blockchains. Real network traffic uses HTTP or DNS.

5. What Victims and Administrators See

  • Users see CRM logins or CAPTCHA checks. They do not understand the command and paste/run it.
  • Typical installers do not stay in the download folder. The PNG looks like a normal browser cache file.
  • SOCs see abnormal parent-child processes and timelines: browser $\rightarrow$ image cache $\rightarrow$ Run/PowerShell/certutil/findstr $\rightarrow$ memory payload.

6. Success and Failure Conditions

Success Conditions

  • The user opens a fake site, pastes the clipboard command, and runs it.
  • The browser saves the image to the cache. The command finds the target by file size.
  • The system gets the public IP, decrypts the payload, checks the hash, and allows C2 HTTP/DNS traffic.

Failure Conditions

  • The user or browser controls block the fake CAPTCHA or clipboard action.
  • EDR or ASR blocks suspicious chains like PowerShell, certutil, or findstr.
  • Network controls block cache images, configs, sessions, blockchain RPCs, or DNS tunneling.

7. What Happens on Success

  • CountLoader or DeviceManager runs in memory. It collects system, antivirus, domain, crypto wallet, and browser data.
  • It sets up persistence using Scheduled Tasks, WMI subscriptions, or LaunchAgents.
  • It enables RAT commands, extra payloads, DNS/HTTP data theft, and the theft of wallet or Signal data.

8. Observable Logs

  • Email: The starting point is unknown. If phishing URLs are used, check senders, URLs, and redirects.
  • Proxy/SWG/DNS: Look for fake sites, /api/config, /session/reg, stego-image.png?sid=, IP echoes, Ethereum/Polygon RPCs, abnormal DNS A/TXT records, and C2 HTTP traffic.
  • Endpoint/EDR: Look for browser cache PNGs, Run/PowerShell/certutil/findstr/mshta/wscript run right after browser use, memory-only execution, Scheduled Tasks/WMI/LaunchAgents, and commands like curl, sw_vers, system_profiler, or ioreg.
  • Identity/IdP: Check for password resets if users put credentials into fake CRM pages. Credential theft is unconfirmed in this text.
  • SaaS/Cloud: Check URL filtering, browser isolations, and login anomalies in tools like Salesforce or HubSpot.
  • Network: Look for public IP lookups followed by payload traffic, high-entropy DNS TXT records, and destination changes after blockchain C2 resolution.

9. Attack Success Determination

  • Contact Only: Site, image, and config are retrieved.
  • User Action: The clipboard command is pasted and run.
  • Initial Execution: The stage is extracted from the cache, and the dropper starts.
  • Malware or Auth Success: The final hash is verified, memory execution starts, and beaconing/system inventory begins.
  • Data Theft / Session Compromise: Data and output are sent via DNS/HTTP. Wallet, browser, or Signal info is gathered.
  • Subsequent Compromise Confirmed: Persistence is set, RAT commands run, and extra MSI/DLL/PowerShell files execute.

10. Investigation Playbook

  • Trigger: Fake CAPTCHA, Run dialog after browser use, cache PNG plus certutil/findstr, abnormal DNS TXT records.
  • Initial Check: Preserve URLs, session IDs, commands, browser/cache paths, image sizes/hashes, and process trees.
  • Endpoint: Check memory captures, Scheduled Tasks/WMI/LaunchAgents, PowerShell/RunMRU, Prefetch, browser history/caches, and access to wallets/extensions/Signal.
  • Auth/Cloud: Revoke credentials entered on fake pages and browser sessions. Check crypto wallet assets from a safe device.
  • Subsequent Actions: Track C2 servers resolved from smart contracts/RPCs, DNS queries/outputs, and downloaded MSI/DLL files.
  • Containment: Isolate endpoints, block domains/IPs/DNS/RPCs, remove persistence, rotate credentials/sessions, and rebuild machines if needed.
  • Judgment Categories: Page Visit / User Command / Stage Extracted / Loader Executed / RAT Beacon / Persistence / Exfiltration.

11. Defense and Detection Ideas

  • Single Event: findstr or certutil targeting browser caches; Run or PowerShell commands right after browser use; WMI persistence.
  • Timeline Correlation: Config $\rightarrow$ PNG cache $\rightarrow$ clipboard $\rightarrow$ LOLBin extraction $\rightarrow$ IP lookup $\rightarrow$ memory payload $\rightarrow$ DNS/RPC C2.
  • Hunting: Search for exact-size cache files, conhost/powershell/mshta with patched PE headers, long DNS TXT responses, and CIS exclusion logic.
  • Missing Logs: Clipboard/Run dialog telemetry, browser cache access, PowerShell Script Block logs, memory load logs, full DNS telemetry, and blockchain RPC logs.
  • Priority Actions: ClickFix training, Run/PowerShell controls, browser isolation, DNS tunneling detection, and WMI/LaunchAgent monitoring.

12. Facts / Inference / Hypothesis

Facts

  • DOUBLECUP is a LaaS active since early June 2026. It features a Go client and a license panel.
  • PNGs are preloaded into browser caches. The malware searches them by file size and uses findstr/certutil to get the stage.
  • It decrypts the final payload using the public IP as key material, verifies it with SHA-256, and runs it in memory.
  • Windows and macOS variants of CountLoader and a new DeviceManager RAT have been confirmed.
  • DeviceManager uses EtherHiding, DNS/HTTP C2, and Scheduled Tasks/WMI.

Inference

  • Downloading a PNG alone has high noise. However, correlating it with subsequent cache searches and LOLBin execution increases detection accuracy.
  • Using the public IP as a key causes decryption to fail in sandboxes or replay environments, slowing down analysis.

Hypothesis

  • Because LaaS customers use different branding and payloads, loader behavior is better for long-term detection than domains or IOCs.

13. MITRE ATT&CK Mapping

  • T1204.002 Malicious File/User Execution (High. Actual behavior is command pasting)
  • T1059.001 PowerShell (High)
  • T1140 Deobfuscate/Decode Files (High)
  • T1027.003 Steganography (High)
  • T1218 System Binary Proxy Execution (High)
  • T1053.005 Scheduled Task, T1546.003 WMI, T1543.001 Launch Agent (High)
  • T1102.003 One-Way Communication (blockchain C2 locator) (Medium)
  • T1071.004 DNS / T1048 Exfiltration Over Alternative Protocol (High)

14. Unknowns and Additional Investigation

  • Number of victims, target regions, and the scope of each customer campaign
  • Complete command sets and subsequent payloads for CountLoader and DeviceManager
  • Ongoing updates to blockchain contracts, C2 servers, and hashes
  • Whether fake CRM pages also gathered credentials

15. Impact on SOCs and General Enterprises

Users of tools like Salesforce, HubSpot, and NetSuite often mistake fake login screens and CAPTCHAs for normal work procedures. The threat targets both Windows and Intel/Apple Silicon macOS, meaning security teams must monitor both development and sales endpoints. Security training should explicitly teach users that "CAPTCHAs never require Win+R, terminals, or PowerShell."

16. Summary by Target Audience

  • For SOCs: Do not look at browser cache PNGs alone. Correlate cache searches $\rightarrow$ LOLBins $\rightarrow$ IP lookups $\rightarrow$ DNS/RPC.
  • For Administrators: Enable PowerShell/Run controls, DNS logging, and WMI/LaunchAgent monitoring. Block CRM-style ClickFix sites.
  • For Users: If a CAPTCHA asks you to copy/paste a command or use Win+R, do not do it. Report the URL and the screen immediately.

Top comments (0)