A newly identified Russian loader-as-a-service called DOUBLECUP is leveraging ClickFix social engineering tactics to hide malicious payloads within PNG images stored in browser caches. The attack chain uses steganography to conceal malware code, ultimately deploying CountLoader and a previously unknown remote access trojan named DeviceManager RAT.
A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager. "The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
