hacker-news Aug 4, 2026 · Crawled Aug 4, 2026

DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

4 IoCs 1 Malware

AI Summary

The DOUBLECUP loader-as-a-service (LaaS) is being used by threat actors to deliver malware such as CountLoader and a previously undocumented Python-based remote access trojan (RAT) called DeviceManager. The attack begins with social engineering lures via fake CRM login pages using ClickFix, which trigger the download of steganographically encoded PNG images into the browser cache. These images contain hidden payloads that, when extracted, execute malicious code to deploy the final malware. CountLoader uses environmental keying based on the victim's public IP address for decryption and establishes persistence by modifying browser shortcuts, while DeviceManager leverages blockchain-based C2 resolution via Ethereum/Polygon smart contracts using EtherHiding.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware CountLoader →

Indicators of Compromise 4 extracted

Type	Value	Detail
IP	213[.]139[.]77[.]109	Details →
IP	91[.]92[.]240[.]100	Details →
Domain	harrypoterlohBOT	Details →
GitHub User	johnnysilverhe	Details →

MITRE ATT&CK TTPs 14 techniques

T1027 Obfuscated Files or Information · Defense Evasion T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1105 Ingress Tool Transfer · Command And Control T1132.001 Standard Encoding · Command And Control T1134.002 Create Process with Token · Defense Evasion T1202 Indirect Command Execution · Defense Evasion T1218.001 Compiled HTML File · Defense Evasion T1480 Execution Guardrails · Defense Evasion T1496 Resource Hijacking · Impact T1566 Phishing · Initial Access T1573.001 Symmetric Cryptography · Command And Control T1610 Deploy Container · Defense Evasion