New Malware DOUBLECUP Uses ClickFix Attacks

A new Loader-as-a-Service called DOUBLECUP has caused a stir in the cybersecurity community. This malware uses ClickFix attacks to hide malicious code in PNG images stored in the cache of the victims' browsers. The attacks target both Windows and macOS systems. The malware is delivered in the form of images that are downloaded by the affected users. Once the images are cached, the malicious code is activated.

This enables the installation of CountLoader, a malware known for its ability to load additional malicious software and take control of the affected systems. In addition to CountLoader, a new Remote Access Trojan (RAT) named DeviceManager is installed on Windows systems. This Trojan allows attackers to access the victims' systems, leading to significant security risks. The spread of this malware occurs through targeted phishing campaigns and other social engineering techniques. Security researchers have found that DOUBLECUP employs a sophisticated method to evade detection by antivirus programs.

By hiding the malware in seemingly harmless images, it becomes more challenging for users and security software to identify the threat. This technique presents a new challenge for the cybersecurity industry. The attacks are not limited to a specific region but affect users worldwide. Security analyses show that the malware is active in various countries, with particularly high prevalence in Europe and North America. The exact number of affected systems is currently unknown; however, reports indicate a significant increase in infections.

To protect against this threat, experts recommend regularly updating security software and being cautious with downloaded content. Users should avoid opening suspicious links or downloading unknown files. Implementing multi-factor authentication can also help reduce the risk of unauthorized access. The security firm Malwarebytes has already taken steps to strengthen its products against this new threat. Researchers are working to identify the specific signatures of the malware to improve detection.

An update for the software is expected in the coming weeks. The discovery of DOUBLECUP highlights the ever-growing challenges in the field of cybersecurity. Attackers continuously develop new techniques to bypass security measures. The cybersecurity community must adapt and develop innovative solutions to keep pace with these threats. The malware DOUBLECUP was first identified in August 2026, and security authorities are warning of a potential increase in attacks in the coming months.