CERT24DOUBLECUP Uses Cached PNGs to Hide Malware and Delivers It via ClickFixLoading data…
CERT24Threat Observatory
Period

DOUBLECUP Uses Cached PNGs to Hide Malware and Delivers It via ClickFix

The Russia-linked loader-as-a-service operation DOUBLECUP uses ClickFix lures to stage steganographic PNG files in victims’ browser caches and deliver CountLoader and the DeviceManager remote access trojan.

← Back to intelligence

DOUBLECUP Uses Cached PNGs to Hide Malware and Delivers It via ClickFix

The Russia-linked loader-as-a-service operation DOUBLECUP uses ClickFix lures to stage steganographic PNG files in victims’ browser caches and deliver CountLoader and the DeviceManager remote access trojan.