DOUBLECUP’s ClickFix service weaponizes PNG cache to deliver fresh RATs
DOUBLECUP, a Russian loader‑as‑a‑service, hides malicious code in PNG images cached by browsers via ClickFix prompts, then steals the payload with certutil or findstr and runs it in memory. It delivers the CountLoader dropper to Windows/macOS and a new Windows RAT called DeviceManager, expanding the attack surface for low‑skill operators.