DOUBLECUP Malware Uses PNG Files to Deliver Payloads

Mon, 24 Aug 2026 11:41:22 +0000

Engineer — Learn: DOUBLECUP embeds payloads inside PNG files as an obfuscation layer rather than true steganography; worth understanding the technique when reviewing file-upload handling and egress filtering in your pipelines, but no patch or config change is required today.
SOC/IR — Learn: The write-up surfaces a payload-delivery method using PNG files, which could inform tuning detections around suspicious image-file execution chains; however, the summary is too truncated to extract IOCs or a concrete detection rule — monitor the full SANS diary for actionable indicators.
Leader — Skip

DOUBLECUP LaaS Uses ClickFix and PNG Steganography to Drop RAT

Tue, 04 Aug 2026 13:07:50 +0000

Engineer — Learn: Novel multi-stage delivery abusing browser cache for steganographic PNG staging is worth understanding when evaluating endpoint controls and browser security policies, but no patch or configuration change is required today.
SOC/IR — Plan: Build or tune detections for ClickFix PowerShell execution patterns and anomalous PNG writes to browser cache directories; the CountLoader → DeviceManager RAT chain provides new TTPs to add to hunt playbooks this quarter.
Leader — Skip