MalwareBleeping Computer
8.0 — CRITICAL
New DOUBLECUP ClickFix service hides malware in browser cache images
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to Windows and macOS devices and a new remote access trojan named DeviceManager to Windows systems. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
The DOUBLECUP loader-as-a-service has been operating since early June 2026, using ClickFix attacks to deliver malware to Windows and macOS devices through steganographic PNG images cached by victims' browsers.
⚙️Technical Details
Affected Systems
WindowsmacOS
Attack Vectors
ClickFix attacksSteganography in PNG images
💥Impact Assessment
Severity: High
Who Is at Risk
Users of Windows and macOS devices, particularly those using ClickFix sites with fake CAPTCHA prompts.
🛡️Recommended Actions
1Implement anti-steganography measures on websites used for ClickFix attacks
2Regularly update and patch operating systems and software to prevent exploitation of vulnerabilities
3Monitor network traffic and system logs for suspicious activity related to PNG image caching
📦Affected Products
ClickFix sitesWindows devicesmacOS devices
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.