securityBACKGROUND
DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager
BACKGROUND
1 SIGNALFIRST DETECTED 4 August 2026
Narrative synthesis pending — 1 signal collected.
How the story developed
4 Aug
DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
REPORT · WHAT · The Hacker News
Other feeds and industry voices
3 Aug
New DOUBLECUP ClickFix service hides malware in browser cache images
A new Russian loader-as-a-service named DOUBLECUP uses ClickFix attacks to hide malicious code in PNG images cached by victims' browsers, ultimately delivering CountLoader to
REPORT · WHAT · BleepingComputerOPEN STORY
24 Aug
DOUBLECUP's PNG Payload, (Mon, Aug 24th)
New malware that uses steganography always gets my attention, but I was disappointed when I looked at the latest DOUBLECUP write-up. It
REPORT · WHEN · SANS Internet Storm CenterOPEN STORY
Sources
The Hacker News
NewsHive monitors these sources continuously. All signal titles above link to the original reporting.
Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →