DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

The Hacker News 4 August 2026, 12:03 EEST Security

A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager. "The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second…

Read the full story on The Hacker News https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html

Attacks like this land on ordinary sites far more often than on chosen targets. If you would rather your site never became the story, CrockyHost hosting ships with daily backups, automatic updates and a firewall we manage.

Keep reading

Hospital operator Nutex Health says data stolen in cyberattack BleepingComputer
A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw The Hacker News
WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android The Hacker News
Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode The Hacker News