DOUBLECUP ClickFix service hides malware in browser cache images

Tue, 04 Aug 2026 13:07:50 +0000

Engineer — Learn: No KEV, EPSS, or PoC signals; this is a novel technique — steganography inside browser-cached PNGs — worth understanding for future detection and hardening decisions, but no immediate patch or config change is indicated.
SOC/IR — Plan: DOUBLECUP introduces a new ClickFix delivery chain that stages payloads inside browser cache images; build or tune detections for ClickFix lure behaviors and monitor for CountLoader/DeviceManager artifacts on Windows and macOS endpoints, but no IOCs are published yet to act on immediately.
Leader — Skip

Loader-as-a-Service on CuraSec