Do Son 
Rognar Actor & Telegram Notifications | Image: STRU
At a Glance
| Attribute | Detail |
|---|---|
| Malware family | DOUBLECUP (Loader-as-a-Service); payloads CountLoader 4.5p and DeviceManager RAT |
| Threat actor | Rognar, a Russian operator (confirmed by SOCRadar) |
| Target / victims | Users lured through fake CRM login pages (NetSuite, Odoo, HubSpot, Salesforce) |
| Delivery vector | ClickFix clipboard hijacking with steganographic PNG images |
| Key capabilities | Fileless loading, environmental keying, blockchain C2, DNS tunneling |
| Source | SOCRadar Threat Research Unit (STRU) |
TL;DR
SOCRadar uncovered DOUBLECUP, a new Russian ClickFix Loader-as-a-Service running since June 2026. It hides payloads inside PNG images and unlocks them with the victim’s own IP address. The service delivers an updated CountLoader and a new RAT called DeviceManager.
Why DOUBLECUP Matters
ClickFix attacks keep growing, and DOUBLECUP lowers the bar further. It sells a ready-made loader to any operator. As SOCRadar puts it, the service gives threat actors “a low-friction, highly reliable payload delivery pipeline.”
The platform runs on a client-server model. Each customer buys a license, then builds campaigns through a payload builder. In short, DOUBLECUP turns loader delivery into a rentable product.
Delivery: Fake CRM Pages and Clipboard Tricks
Recent campaigns impersonate major CRM login pages. SOCRadar found clusters mimicking NetSuite, Odoo, HubSpot, and Salesforce. Attackers inject DOUBLECUP into these pages through hidden iframes.
The page then runs a ClickFix routine. It reads the victim’s browser, copies a matching command to the clipboard, and shows fake CAPTCHA instructions. The victim pastes the command and starts the infection.
Infection Chain
Steganography and Environmental Keying
DOUBLECUP forces the browser to cache a steganographic PNG image. The pasted command finds that image by file size and extracts hidden code from it. That code launches a fileless second stage.
The second stage is where the clever part begins. It fetches the victim’s public IP address and uses it as a decryption key. According to SOCRadar, this “environmental keying” locks the payload to the target.
The dropper derives a key from that IP through PBKDF2. It then runs a custom SHA-256 stream cipher in CTR mode with XOR. If an analyst runs the sample in an offline sandbox, the key is wrong and decryption fails.
Final Payloads
CountLoader 4.5p
The first payload is an updated CountLoader, now built as fileless PowerShell for Windows and Mach-O for macOS. Its standout trick is process masquerading. It copies conhost.exe, powershell.exe, and mshta.exe, then patches their PE headers with names of trusted apps.
CountLoader also hunts for value. It audits browser extensions for crypto wallets and profiles the host for Signal Desktop. For persistence, it hides scheduled tasks named like Google and Edge update services.
DeviceManager RAT
The second payload is DeviceManager, a new Python-based RAT. It stands out for its C2 resolution. Rather than hardcoding a server, it uses EtherHiding to read its C2 address from an Ethereum or Polygon smart contract.
This design resists takedowns. Defenders cannot simply block one domain, since the operator can update the address on-chain. DeviceManager then talks to its server over DNS tunneling or HTTP.
Command and Control
DeviceManager’s DNS channel hides in plain sight. Every query appends a “microsoft.com” apex domain. To a defender reading DNS logs, the traffic looks like normal Microsoft telemetry.
The RAT also checks its environment first. If it detects a CIS-region language, it deletes itself and exits. This behavior points strongly to a Russian-speaking operator avoiding local victims.
Attribution
Attribution here is confirmed by SOCRadar. The researchers link DOUBLECUP to a threat actor known as Rognar. This operator was previously tied to malicious VS Code extensions and runs a Telegram bot for campaign alerts.
Defense and Detection Guidance
Train staff to distrust CAPTCHA pages that ask them to paste commands into the Run box. That single habit breaks the ClickFix chain.
SOCRadar warns that “static IOCs and basic process-matching rules will no longer suffice.” Therefore, focus on behavior. Watch for browsers caching odd PNG files, patched system binaries running from user folders, and DNS queries with long encoded subdomains.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
