DOUBLECUP Browser Cache Malware: How It Evades Detection

SOCRadar's Threat Research Unit identified DOUBLECUP during an investigation of an open directory at 213[.]139.77[.]109:9090. They uncovered a Russian-linked loader-as-a-service (LaaS) that facilitates "ClickFix" campaigns, a novel method of delivering DOUBLECUP browser cache malware by hiding payloads in seemingly innocuous images. For more details on their findings, you can visit the SOCRadar Threat Research blog.

What Actually Happened: Uncovering DOUBLECUP Browser Cache Malware

What sets this service apart from typical drive-by download mechanisms is that DOUBLECUP provides the infrastructure to host steganographic PNG images, manage session endpoints, and rebuild payloads, effectively serving as a platform for DOUBLECUP browser cache malware. The attackers, acting as customers, are responsible for setting up phishing sites and embedding the generated frontend code. Customers configure their campaigns using a Go-based Windows application, specifying parameters like domain, URL path, steganography method, and payload locations. The service also provides C2 management via a Telegram bot (@harrypoterlohBOT), linked to the threat actor 'johnnysilverhe', which tracks client visits and delivers commands.

Targets include Chrome, Edge, Firefox, Brave, and Opera users on both Windows and macOS. The lures employ common social engineering: fake CAPTCHA prompts on imposter login pages for services like NetSuite, Odoo, HubSpot, and Salesforce, often loaded via iframes. However, the delivery mechanism itself is novel. While ClickFix attacks have previously leveraged steganography to conceal payloads like LummaC2 and Rhadamanthys within PNG pixel data, DOUBLECUP distinguishes itself by offering a full loader-as-a-service infrastructure for this specific method.

The Attack Chain: From Cache to C2

Let's break down the compromise chain of DOUBLECUP browser cache malware:

1. Initial Lure: A victim lands on a malicious ClickFix site, typically a fake login page with a CAPTCHA.
2. Session Registration: DOUBLECUP registers the victim's session and records their public IP address. This IP is critical for subsequent payload decryption.
3. Cache Poisoning: The victim's browser is forced to download and cache an ordinary-looking PNG image. This image, however, contains a hidden first-stage payload embedded within its pixel data using steganography, a hallmark of DOUBLECUP browser cache malware.
4. User Execution: The fake CAPTCHA instructions prompt the victim to paste and execute a command already copied to their clipboard. This social engineering step is crucial because it tricks the user into initiating the payload.
5. Payload Recovery: The executed command, typically using built-in Windows utilities like findstr or certutil, searches the browser cache for the specific PNG (often by file size). It then recovers the hidden first-stage payload.
6. Second-Stage Dropper: This first payload is fileless and launches a second-stage dropper.
7. Decryption Key Generation: The dropper retrieves the victim's public IPv4 address again. This IP is used as a seed to create a decryption key for the final payload, employing a custom SHA-256 stream cipher in Counter (CTR) mode, with the key derived by a bitwise XOR operation using the victim's public IP address. This 'environmental keying' is a clever trick, making it much harder for researchers to analyze the payload in a controlled sandbox.
8. Final Payload Execution: The decrypted final payload is verified against a hardcoded SHA-256 hash and then executed directly in memory.

<figcaption>Malware hidden in browser cache.</figcaption>

This multi-stage approach, particularly the cache-based delivery, contributes to DOUBLECUP's effectiveness at bypassing standard network firewalls and security tools. The initial "malicious" activity is a cached image download, a type of traffic that most firewalls typically do not flag as suspicious.

The Payloads: CountLoader and DeviceManager

The DOUBLECUP browser cache malware operation primarily deploys two distinct malware families:

• CountLoader: This is an updated loader targeting both Windows and macOS (including Apple Silicon). It is designed for system reconnaissance, checking for cryptocurrency wallet applications, browser extensions, and Signal Desktop installations. It establishes persistence via scheduled tasks on Windows or LaunchAgents on macOS and can download and execute additional files like MSI packages or PowerShell modules. Notably, researchers identified an uninvoked feature designed to scan for browser shortcut (.LNK) files to rewrite targets, though this code appears incomplete. For evasion, CountLoader copies and header-patches legitimate Windows binaries.

• DeviceManager RAT: This is a new, previously undocumented, modular Python-based Remote Access Trojan, specifically for Windows. It is distributed via a Delphi-compiled Inno Setup installer that embeds an encrypted payload and extracts a full Python environment. Its C2 server has been observed at 91.92.240[.]100. It collects extensive system information including machine GUID, disk identifier, user SID, hostname, username, operating system version, architecture, installed antivirus software, and domain information (specifically in non-CIS countries).

  Its C2 mechanism, dubbed EtherHiding, is particularly notable. DeviceManager leverages Ethereum or Polygon blockchain smart contracts to dynamically determine its C2 server IP address. This approach grants its C2 infrastructure high resilience to disruption, as traditional methods of sinkholing a single IP are ineffective against a decentralized blockchain. It collects extensive system information and uses DNS A and TXT records for communication, further blending in with normal network traffic. It also incorporates an anti-analysis feature, avoiding execution in Commonwealth of Independent States (CIS) language locales and self-delating if detected.

Why This Attack Is Hard to Stop

The security community, including SOCRadar's Threat Research Unit, has highlighted the implications of DOUBLECUP, with particular emphasis on the evasiveness of "Browser Cache Smuggling" as a key challenge. These techniques underscore the sophisticated evasion tactics employed by DOUBLECUP browser cache malware.

1. Steganography and Cache Abuse: Hiding malware in cached images means the initial download appears as normal web traffic. Traditional network proxies and firewalls often do not inspect image content for hidden code, making DOUBLECUP browser cache malware particularly stealthy. The malicious activity only commences *after* the user executes a command, long after the "malware" has landed.
2. Environmental Keying: Using the victim's public IP for payload decryption complicates analysis in a sandbox environment. If the IP does not match, the payload will not decrypt correctly.
3. Blockchain C2 (EtherHiding): DeviceManager's use of smart contracts for C2 resolution represents a notable evolution in C2 resilience because it moves away from easily disruptable fixed IPs or domains. Instead of a fixed IP or domain that can be taken down, the C2 address is pulled from a decentralized, censorship-resistant blockchain. This adds a new layer of complexity for defenders, who must now monitor blockchain activity for C2 resolution.
4. Social Engineering: The ClickFix method relies on tricking users into pasting and executing commands. By tricking users into executing commands, this method effectively bypasses many technical controls designed to prevent initial execution.

This combination means that traditional signature-based detections and even some behavioral EDRs may struggle with the initial stages. The attack chain is cleverly crafted to remain undetected until the final stage.

What We Need to Do About It

To counter DOUBLECUP browser cache malware, we need a defense strategy that hits on multiple fronts, from how users behave to the technical controls we put in place.

A strong defense starts with empowering users through education. Users must be explicitly trained against pasting commands from untrusted websites into their terminals, regardless of the prompt's apparent legitimacy. Making this a core part of all security awareness programs is essential.

Organizations should tighten browser security policies, particularly concerning caching and script execution. Instead of an impractical blanket ban on image caching, organizations should focus on monitoring for anomalous cache activity or unusually large image downloads, which can provide early indicators of compromise.

Endpoint Detection and Response (EDR) solutions need to get smarter at detecting the *behavior* of executed commands. Specifically, EDRs should flag instances of findstr or certutil extracting data from browser cache directories, especially when these actions precede suspicious process creation or in-memory execution. Detecting this behavioral anomaly is crucial for catching the attack early.

Strict application control policies can prevent unauthorized executables from running, even when recovered from a cached image. For example, if cmd.exe or PowerShell exhibits unusual execution patterns, application control can intervene.

Given DeviceManager's reliance on DNS for C2, continuously monitoring DNS queries is key. This includes identifying suspicious patterns, resolutions to known malicious IPs, or unusual record types.

Even though the initial image download seems benign, the subsequent C2 communication from CountLoader or DeviceManager happens over the network. Behavioral analysis of outbound connections, looking for unusual protocols or destinations, is crucial for detecting C2 activity. For EtherHiding, this involves monitoring connections to Ethereum/Polygon nodes; while legitimate for some organizations, such traffic can indicate anomalous activity in others.

DOUBLECUP shows how attackers are getting smarter with initial access and C2 resilience. We can't just block known bad files anymore; we need to grasp and detect the whole, often subtle, sequence of events. The browser cache, once ignored, is now a prime target for DOUBLECUP browser cache malware.