DOUBLECUP “ClickFix” Loader‑as‑a‑Service Hides Malware in Browser‑Cache PNGs
What Happened – A Russian‑origin threat‑as‑a‑service called DOUBLECUP offers a “ClickFix” campaign kit that embeds malicious payloads inside PNG images cached by a victim’s browser. The loader delivers the CountLoader dropper to Windows/macOS and a custom RAT (DeviceManager) to Windows, using fake CAPTCHA prompts that mimic SaaS login pages.
Why It Matters for Compliance & Audit Readiness
- The technique blends phishing with steganographic malware delivery, a scenario SOC 2 Security (CC6.1) controls are designed to detect and mitigate through documented security‑awareness training and phishing‑simulation evidence.
- Continuous‑compliance programs must capture evidence that staff are regularly tested against such social‑engineering attacks and that remediation actions are tracked in audit logs.
- Verisq’s Security Awareness Training capability provides the tooling and audit‑ready evidence needed to satisfy SOC 2 requirements for phishing resilience.
Who Is Affected – SaaS providers (CRM, ERP, marketing platforms), their customers, and any organization whose employees access web‑based login portals.
Recommended Actions
- Map SOC 2 CC6.1/CC6.2 controls to a formal security‑awareness program; include simulated ClickFix‑style phishing tests.
- Capture training completion, test results, and remediation steps as continuous audit evidence.
- Review web‑application security controls to detect anomalous image‑loading behavior and enforce content‑security policies.
Source: BleepingComputer
Technical Notes – DOUBLECUP uses a Go‑based Windows tool to generate steganographic PNGs, an API endpoint that serves the image, and clipboard‑copy commands that execute via findstr or certutil. Payloads are file‑less first‑stage dropper → CountLoader / DeviceManager. No CVE is associated; the threat relies on social engineering and browser‑cache abuse.