Overview
- Researchers reported that a new loader-as-a-service called DOUBLECUP supplies infrastructure and a Go-based campaign generator that customers use to build ClickFix phishing campaigns.
- The attack flow preloads a malicious PNG into the browser cache, copies a clipboard command for the victim to run, extracts a hidden first-stage payload with findstr or certutil, and launches a fileless dropper that derives a decryption key from the victim's public IPv4 address.
- Observed final payloads include an updated CountLoader with Windows and macOS variants that harvests system and crypto-related data and establishes persistence, and a previously undocumented Windows RAT named DeviceManager that resolves C2 via Ethereum/Polygon smart contracts and DNS A/TXT records.
- DOUBLECUP hosts steganographic images, manages session and key material, and automatically rebuilds payloads while customers are responsible for creating and hosting the fraudulent ClickFix pages and adding front-end code.
- The use of browser cache steganography, clipboard social engineering, fileless decryption keyed to a target device, and blockchain-based C2 resolution complicates detection and takedown, so defenders should monitor clipboard activity, browser cache artifacts, and smart-contract lookups for signs of compromise.