A new Russian loader-as-a-service operation called DOUBLECUP has been active since early June 2026, hiding malware inside PNG images stored in victims' browser caches and delivering remote access trojans through fake corporate login pages, according to a technical report from SOCRadar. The service provides operators with licenses and a client agent to build campaigns that impersonate CRM platforms like NetSuite, Odoo, HubSpot, and Salesforce. The attack chain ultimately deploys CountLoader, which now has both Windows and macOS variants, and a previously unknown trojan named DeviceManager that uses blockchain contracts to locate its command-and-control servers.
The DOUBLECUP service was discovered after SOCRadar found an open directory at IP address 213.139.77[.]109:9090 that exposed testing files linked to the loader's license panel. Each license issued to an operator contains a unique key along with metadata showing the client's IP address, active days, label, and version, with multiple campaigns possible per license. The Go-based Windows GUI client lets operators update configurations, issue commands through a Broadcast Pane, and use a Payload Builder Pane to configure the domain, slug, steganography method, embed type, archive format, action, and payload URLs. A Telegram bot managed by a threat actor using the handle "johnnysilverhe" tracks client visits, sends commands, delivers keys, and receives payload callbacks via a designated DOUBLECUP URL. The same actor published a suspicious Microsoft Visual Studio Code extension called Agent IDE in the official marketplace.
"The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second stage," the report states. The second stage decrypts the final payload in memory using a custom SHA-256 stream cipher in Counter mode combined with bitwise XOR, with the victim's public IP address serving as the cryptographic key. This environmental keying technique ensures the payload can only be unpacked on the intended victim's machine, since the decryption fails on any other device that would generate the wrong key. SOCRadar explains that CountLoader includes "a function that scans the desktop and start menu for shortcuts (.LNK files) belonging to popular web browsers," rewriting their targets so double-clicking a browser shortcut secretly launches both the browser and the RAT simultaneously, though this function is never actually invoked and may represent incomplete or developmental code.
The attack works by embedding iframe elements on bogus sites that mimic CRM login pages, triggering ClickFix commands that search the browser cache for the PNG image and extract malicious JavaScript, VBScript, or PowerShell to launch the next component. The second-stage dropper notifies the C2 server of a successful infection, deploys an encrypted payload, then redirects the victim to a destination page. CountLoader's updated Windows and macOS versions now establish persistence using scheduled tasks, audit installed browser extensions for cryptocurrency wallets, and check whether Signal's desktop app is present. The malware connects to a C2 server, gathers and exfiltrates system metadata, and awaits tasks that can run secondary executables, DLLs, MSI, or HTA files, download compressed archives, extract their contents, run the main binary, and clean up persistence mechanisms to erase forensic evidence. DeviceManager, the second payload, is distributed as a Delphi-compiled Inno Setup installer embedding an encrypted payload that extracts a full Python environment to spawn the Python-based RAT. It deliberately avoids executing on machines with Commonwealth of Independent States language locales, triggering a self-deletion routine that removes its scheduled task, deletes its installation directory, and terminates the process if a CIS language is detected. The trojan dynamically resolves its active C2 nodes via Ethereum and Polygon smart contracts—a technique called EtherHiding—before communicating with the server at 91.92.240[.]100 using DNS or HTTP to exfiltrate data, poll for tasks, download payloads, send command results, and report status. Organizations relying on browser-based workflows and CRM platforms face heightened risk, as the steganography and environmental keying techniques bypass many traditional defenses while the blockchain-based C2 resolution makes takedown efforts significantly harder. The marriage of legitimate-looking corporate login pages with advanced evasion methods means security teams can't rely solely on signature-based detection or domain blocklists to stop this threat.