Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

DOUBLECUP loader-as-a-service expands ClickFix campaign tooling for Windows and macOS

Threat Actor Meta
First reported
Last updated
Happening score
H score 28
2 unique sources, 2 articles

Summary

Hide ▲

DOUBLECUP is a Russian loader-as-a-service that packages ClickFix campaign tooling and has been active since early June 2026, according to SOCRadar. It supplies licenses, a Go-based Windows builder/client, and backend functions that generate campaign code, manage steganographic PNG delivery, and support operators who embed the required code in their ClickFix landing pages. Campaigns tied to the service have impersonated NetSuite, Odoo, HubSpot, and Salesforce login pages and delivered CountLoader for Windows and macOS plus a DeviceManager RAT for Windows. The service lowers the barrier for browser-based malware delivery by combining cache-based staging, operator tooling, and EtherHiding-backed C2 handling.

Related Happenings

ClickFix AmnesiaStealer distribution campaign targeting mac users

Campaign
H score22 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: A ClickFix campaign is distributing AmnesiaStealer to macOS users through a counterfeit GitHub "Download for macOS" page and a copy-and-paste command that launches...

Latest development: 16.08.2026 18:07

Jamf described AmnesiaStealer's stream_module and remote_stream commands, which copy a victim's Chromium profile into a hidden headless browser and open WebSocket and Chrome DevTools Protocol channels through webSocketDebuggerUrl. The operator can issue navigation and mouse commands, receive live screencasts, and export or import cookies to operate online portals inside the victim's authenticated sessions on Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, Brave, and Chromium.

Open Happening

AmnesiaStealer macOS infostealer distributed via ClickFix

Malware Activity
H score16 First: 14.08.2026 13:45 Last: 14.08.2026 13:45 Sources 1

About this happening: AmnesiaStealer is a Rust-based macOS infostealer spread through a counterfeit GitHub "Download for macOS" page and ClickFix-style lure. It steals Keychain, b...

Open Happening

DOUBLECUP customer ClickFix campaign targeting impersonated SaaS login pages

Campaign
H score39 First: 03.08.2026 23:01 Last: 03.08.2026 23:01 Sources 1

How related: SOCRadar says it observed DOUBLECUP ClickFix campaigns using fake CAPTCHA prompts on login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce, with the malicious code loaded through embedded iframes.

About this happening: The DOUBLECUP ClickFix campaign uses fake CAPTCHA prompts on impersonated NetSuite, Odoo, HubSpot, and Salesforce login pages to trick visitors into runnin...

Open Happening

DOUBLECUP ClickFix-delivered CountLoader and DeviceManager malware activity

Malware Activity
H score22 First: 03.08.2026 23:01 Last: 03.08.2026 23:01 Sources 1

How related: A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager.

About this happening: DOUBLECUP is a Russian loader-as-a-service active since early June 2026 that uses ClickFix lures and browser-cached steganographic PNGs to deliver CountLoade...

Open Happening

Y2K Operators Millenium RAT social-engineering distribution campaign

Campaign
H score73 First: 29.06.2026 17:30 Last: 29.06.2026 17:30 Sources 1

About this happening: The Y2K Operators are running a social-engineering distribution campaign that spreads Millenium RAT through booby-trapped downloads, exposing users to remote compr...

Open Happening

Timeline

  1. 03.08.2026 23:01 3 articles · 13d ago

    SOCRadar details DOUBLECUP ClickFix malware delivery service

    Initial Disclosure

    SOCRadar describes DOUBLECUP as a Russian loader-as-a-service that packages ClickFix campaign tooling, provides licenses and a Go-based Windows builder, and supports malware delivery through steganographic PNG images cached in victims' browsers. The service is tied to fake CAPTCHA prompts on login pages impersonating NetSuite, Odoo, HubSpot, and Salesforce, and SOCRadar says it has operated since early June 2026 while delivering CountLoader to Windows and macOS and a Windows DeviceManager RAT.

    Show sources
    Open in new tab