DOUBLECUP ClickFix Service Hides Malware in Browser Cache Images
The DOUBLECUP loader uses ClickFix attacks to embed malware within PNG images cached by browsers on Windows and macOS, complicating detection.
Why it matters
This technique leverages browser cache images to stealthily deliver malware, increasing detection challenges and raising the importance of targeted monitoring by security teams.
SOC impact
Defenders should focus on detecting unusual cached image files that may contain embedded malware and monitor for activity related to CountLoader and the DeviceManager remote access trojan across Windows and macOS environments.
Recommended actions
- Identify cached PNG images that could contain embedded malware
- Monitor endpoints for signs of CountLoader and the DeviceManager trojan
- Review network traffic for anomalies associated with malware delivery
- Assess browser cache handling and storage for suspicious activity
- Correlate endpoint alerts with suspicious image file execution or access
Executive Summary
A newly identified loader-as-a-service called DOUBLECUP employs a novel ClickFix technique to embed malware inside PNG images cached by browsers, targeting both Windows and macOS systems. This method delivers CountLoader and DeviceManager, a Windows remote access trojan, by hiding malicious payloads within seemingly benign browser cache images. The approach complicates traditional malware detection practices, as the payloads evade typical file scanning and analysis methods focused on executable files. Security operations teams must adjust detection strategies to include behavioral monitoring and in-depth inspection of browser cache artifacts to mitigate this stealthy delivery mechanism.
SOC Impact
Defenders should focus on detecting unusual cached image files that may contain embedded malware and monitor for activity related to CountLoader and the DeviceManager remote access trojan across Windows and macOS environments.
Focus Areas for Detection and Exposure Assessment
- Identify cached PNG images that could contain embedded malware
- Monitor endpoints for signs of CountLoader and the DeviceManager trojan
- Review network traffic for anomalies associated with malware delivery
- Assess browser cache handling and storage for suspicious activity
- Correlate endpoint alerts with suspicious image file execution or access
Why It Matters
This technique leverages browser cache images to stealthily deliver malware, increasing detection challenges and raising the importance of targeted monitoring by security teams.