NewsHive
CONTACT USANALYST PORTAL →
securityBACKGROUND

New DOUBLECUP ClickFix service hides malware in browser cache images

BACKGROUND
1 SIGNALFIRST DETECTED 3 August 2026
Narrative synthesis pending — 1 signal collected.
How the story developed
Other feeds and industry voices
4 Aug
DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately

REPORT · HOW · The Hacker NewsOPEN STORY
6 Oct
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits

A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of downloading and

REPORT · WHO · The Hacker NewsOPEN STORY
16 Jun
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, per independent

REPORT · WHAT · The Hacker NewsOPEN STORY
24 Aug
DOUBLECUP's PNG Payload, (Mon, Aug 24th)

New malware that uses steganography always gets my attention, but I was disappointed when I looked at the latest DOUBLECUP write-up. It

REPORT · WHEN · SANS Internet Storm CenterOPEN STORY
Sources
BleepingComputer

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →