DOUBLECUP hides the next stage in an image and lets the user start the attack

SOCRadar published an analysis on 3 August 2026 of DOUBLECUP, a Russian loader sold as a service and used in ClickFix campaigns since early June. The operators embed the code in fake login pages impersonating NetSuite, Odoo, HubSpot and Salesforce. The service places a PNG image with hidden content in the browser cache, persuades the user to paste and run a command, and decrypts the next stage in memory using the victim's public IP address. The observed payloads are CountLoader for Windows and macOS and a previously undocumented Windows remote access trojan named DeviceManager. The report lists infrastructure, file hashes, domains, execution details and MITRE ATT&CK mappings.

What happens technically

ClickFix is the name of an approach where the victim does the work. The page shows an error message or a verification step that looks routine, and asks the user to copy a piece of text and run it in a command window. The attack thereby passes much of what would otherwise stop attachments and downloads, because the command comes from the user's own fingers rather than from a file that can be scanned.

DOUBLECUP adds two layers to that approach. The first is that the code is hidden in an image already sitting in the browser cache, meaning steganography. To anyone watching network traffic it looks like an ordinary image download. The second is that the next stage is decrypted in memory using the victim's public IP address as part of the key. The consequence is that a sample collected and analysed somewhere else will not open, because the analysis machine has a different IP address from the victim. This is a known way of frustrating sandbox analysis, and it makes investigation heavier without changing what happens at the victim. SOCRadar states that the report contains infrastructure, file hashes and domains, which is exactly what is needed to search for traces in your own logs.

What this means for you if you are responsible for staff machines

The impersonated services say something about which of your machines the attack is after. NetSuite, Odoo, HubSpot and Salesforce are systems for finance, customers and sales. The people who log into those systems are not random users, but staff with access to customer data, quotes and invoicing. If a loader gains a foothold on one of those machines, in our view you do not merely have an infected PC. You have a way into your own business data.

The other side of the case is that the defence is easy to describe and hard to introduce. The attack requires a user to paste and run a command. If you have limited who may run scripts and commands on their own machine, you remove precisely that decisive step. Berigo sees this work stall because developers and operations staff need exceptions. Our assessment is that the exception should be a deliberate choice with compensating monitoring, and not a state of affairs nobody decided.

Berigo recommends

• Limit who may run commands and scripts in PowerShell and the terminal, and make the exceptions named and time limited.
• Alert when a browser launches a command window, since that pattern has few valid explanations.
• Take the indicators from the report, meaning domains and file hashes, and search backwards through your own logs.
• Tell staff that no genuine error message asks them to paste a command, and that the right answer is to get in touch.
• Bring Mac machines into the same monitoring as Windows, since one of the payloads also reaches macOS.