- Engineer — Learn: No KEV, EPSS, or PoC signals; this is a novel technique — steganography inside browser-cached PNGs — worth understanding for future detection and hardening decisions, but no immediate patch or config change is indicated.
- SOC/IR — Plan: DOUBLECUP introduces a new ClickFix delivery chain that stages payloads inside browser cache images; build or tune detections for ClickFix lure behaviors and monitor for CountLoader/DeviceManager artifacts on Windows and macOS endpoints, but no IOCs are published yet to act on immediately.
- Leader — Skip