Plan
active
DOUBLECUP ClickFix service hides malware in browser cache images
- Engineer — Learn: No KEV, EPSS, or PoC signals; this is a novel technique — steganography inside browser-cached PNGs — worth understanding for future detection and hardening decisions, but no immediate patch or config change is indicated.
- SOC/IR — Plan: DOUBLECUP introduces a new ClickFix delivery chain that stages payloads inside browser cache images; build or tune detections for ClickFix lure behaviors and monitor for CountLoader/DeviceManager artifacts on Windows and macOS endpoints, but no IOCs are published yet to act on immediately.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.