Loading story…
Researchers reported a Russian loader-as-a-service operation named DOUBLECUP that uses ClickFix social-engineering lures and steganographic PNG images stored in victims’ browser caches to deliver malware. The service, active since early June 2026, offers customers campaign-building tooling, licensed infrastructure, encryption support, automated payload rebuilding, a Go-based client, and a Telegram bot for visit tracking, key delivery, and command handling, while affiliates provide the lure sites. Observed campaigns impersonated business and CRM login pages including NetSuite, Odoo, HubSpot, and Salesforce, presenting fake CAPTCHA prompts that trick users into running clipboard-copied commands.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
SOCRadar linked the Telegram bot used for DOUBLECUP operational notifications to the threat actor Rognar and associated the actor with the Telegram username @johnysilverhe. This added an attribution element to prior reporting on the loader-as-a-service operation.
SOCRadar assessed that the Russian loader-as-a-service operation DOUBLECUP had been active since early June 2026. The service provided licensed tooling and infrastructure for ClickFix-based malware delivery campaigns.
SOCRadar observed DOUBLECUP distributing updated Windows and macOS variants of CountLoader as well as a previously undocumented Windows RAT called DeviceManager. DeviceManager was described as a modular Python-based RAT that used EtherHiding through Ethereum or Polygon smart contracts and DNS records to locate command-and-control infrastructure.
SOCRadar identified DOUBLECUP as a new Russian loader-as-a-service that uses fake CAPTCHA-style ClickFix lures and steganographic PNG images cached in browsers to deliver malware. The documented chain used impersonated CRM and business login pages to trick victims into executing clipboard-copied commands that extracted hidden payloads and ran them in memory.
While investigating an open directory at 213.139.77.109:9090 containing test files, SOCRadar discovered infrastructure tied to DOUBLECUP. The same IP address was later identified as hosting the service's licensing panel.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
isc.sans.edu
Open sourcexakep.ru
Open sourcerhisac.org
Open sourcecommunity.gurucul.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcesocradar.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
Microsoft reported that social-engineering lures are increasingly being used to trick users into launching malware themselves, with the **ClickFix** technique emerging as a major delivery method across phishing, malvertising, and compromised websites. In ClickFix attacks, victims are shown fake CAPTCHA, verification, or repair prompts that copy malicious commands to the clipboard and persuade them to run them, often leading to fileless execution through LOLBins, obfuscated PowerShell, and follow-on payloads such as **Lumma Stealer**, **DarkGate**, **Latrodectus**, **ScreenConnect**, and **AMOS**. Microsoft said the technique has hit thousands of enterprise and consumer devices daily and is now supported by a growing underground market of ClickFix builder kits sold on criminal forums. Fresh activity shows the tactic continuing to evolve. A **SmartApeSG** campaign observed on compromised web traffic redirected victims to a fake human-verification flow that fetched an HTA downloader from `deltaode[.]com`, retrieved a ZIP archive, and abused DLL side-loading to launch an unidentified RAT that later communicated with `89.124.79[.]98` over TCP 443. Separately, Microsoft linked the **CaptiveCrunch** campaign to **Storm-2945**, a sub-cluster of Russia-linked **Midnight Blizzard**, which has manipulated DNS and HTTP traffic on hospitality and other captive-portal networks to redirect travelers to phishing pages and fake browser or OS updates delivering **CornFlake** and **ChocoShell** for credential theft and espionage, including theft of browser credentials, Microsoft 365 tokens, and Wi-Fi credentials.
Aug 24, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026