DOUBLECUP ClickFix loader service

Summary

SOCRadar published this on 3 August 2026, introducing DOUBLECUP, which it describes as a Russian loader-as-a-service for ClickFix campaigns, active since early June 2026. Paying customers paste its front-end code into lure pages they run themselves. The page registers a session, has the browser quietly cache a PNG with code hidden inside it, and shows a fake CAPTCHA that puts a browser-specific command on the clipboard. Run from the Run dialog, the command finds the cached image by its exact size, pulls out the hidden stage with built-in Windows tools, and decrypts the final payload with a key derived from the victim's public IP, so a sandbox elsewhere gets nothing. SOCRadar followed fake NetSuite, Odoo, HubSpot and Salesforce login pages that delivered an updated CountLoader and a new Python RAT, DeviceManager, which reads its C2 from a blockchain contract.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

1 of 43

Checks recorded

1

Checks since publication

1

Never checked

42

Observation window 2026-10-11 to 2026-10-11. Checks are sampled, not continuous; the sampling policy is on /methodology. 42 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 4 of these mechanisms appear together in 3 of the 61 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

43 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.