Introduction to DOUBLECUP Malware
A newly discovered Russian loader-as-a-service, DOUBLECUP, has been found to utilize ClickFix attacks to conceal malicious code within PNG images stored in the browser cache of unsuspecting victims. This ingenious tactic ultimately leads to the delivery of CountLoader and DeviceManager malware to Windows and macOS devices.
DOUBLECUP's Mode of Operation
DOUBLECUP operates by providing its customers with licenses and a Go-based Windows tool, which facilitates the creation of malicious campaigns. The service handles various aspects of the attack infrastructure, including hosting steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads.
The customers of DOUBLECUP are responsible for creating and hosting the websites that display the ClickFix prompts, adding the generated frontend code, and implementing any additional obfuscation or anti-analysis measures.
Discovery of DOUBLECUP
DOUBLECUP was discovered by SOCRadar's Threat Research Unit while investigating an open directory at 213[.]139.77[.]109:9090, which contained test files. The same IP address was later identified as hosting the service's licensing panel.
Launch of a DOUBLECUP Attack
To launch an attack, a DOUBLECUP customer uses the Go-based Windows application to configure the campaign's domain, URL path, steganography method, embed type, execution action, and payload locations. This generates an API configuration endpoint that returns the steganographic image URL and file size, session endpoint, and commands customized for various browsers.
Operators then add DOUBLECUP's code to their ClickFix sites, which retrieves the configuration, preloads the steganographic image into the victim's browser cache, registers the session, selects the command matching the victim's browser, and copies it to the clipboard when the page is opened.
Malware Hidden in Browser Cache
DOUBLECUP ClickFix campaigns have been observed using fake CAPTCHA prompts on login pages impersonating reputable services. When a victim visits one of these sites, DOUBLECUP registers the session, determines the victim's public IP address, and forces the browser to download and cache a malicious PNG image.
The page then displays fake CAPTCHA-style instructions that attempt to convince visitors to paste and run a command automatically copied to their clipboard.
DOUBLECUP Attack Flow
Once executed, the command searches the browser cache for the PNG based on its exact file size and uses the findstr or certutil commands to recover and execute the hidden first-stage payload inside the image. The first payload launches a fileless second-stage dropper, which retrieves the victim's public IPv4 address and uses it to create a decryption key for the final encrypted payload.
After verifying the decrypted payload against a hardcoded SHA-256 hash, the dropper executes it in memory.
Malware Payloads Delivered by DOUBLECUP
Two malware families have been identified as being delivered through DOUBLECUP: an updated version of CountLoader, which targets Windows and macOS, and a previously undocumented DeviceManager RAT.
CountLoader is used to harvest information about infected systems, checks for cryptocurrency wallet applications and browser extensions, determines whether Signal Desktop is installed, and establishes persistence through scheduled tasks.
DeviceManager, on the other hand, is a modular Python-based Windows RAT that uses blockchain smart contracts to determine the IP address of its command-and-control server.
Security Implications
The discovery of DOUBLECUP highlights the importance of testing every layer of security before attackers can exploit them. According to a Picus whitepaper, security teams log 54% of successful attacks and alert on just 14%, while the rest move through the environment unseen.
This underscores the need for breach and attack simulation tests to ensure that SIEM and EDR rules are effective in stopping threats from slipping by detection.
Source: BleepingComputer