ScanMalware.com
Known malicious kitcriticalphishing

DOUBLECUP ClickFix Loader-as-a-Service (CountLoader / DeviceManager RAT)

family: doublecup-clickfix-laas

Rented ClickFix delivery service active since June 2026. Operators embed a fixed frontend snippet into their own lure pages; DOUBLECUP hosts the steganographic PNG, the session endpoints and the encryption keys. Stage 1 is a clipboard command that finds the cached PNG by exact file size and carves an embedded script out of it, so nothing is downloaded at execution time. Stage 2 derives its decryption key from the victim's public IP, meaning the payload will not decrypt in an offline sandbox. Observed payloads: CountLoader 4.5p (Windows PowerShell and macOS Mach-O) and DeviceManager, a Python RAT that resolves C2 from Ethereum/Polygon smart contracts (EtherHiding) and tunnels over DNS using microsoft.com as a decoy apex.

Anchors

YARA ruleDetect_DOUBLECUP_Loader_Frontend
SMQL queryrun
ip:213.139.77.109 OR ip:80.96.109.229 OR ip:167.148.201.131 OR ip:89.124.117.12 OR ip:103.22.137.227 OR ip:67.219.107.181 OR ip:146.70.124.154 OR ip:91.92.240.100 OR domain:srv641398444.host.ultaserver.net OR domain:*nxtdrcliam.site

Provenance

Added: 2026-08-04 08:51
Two anchors, deliberately. The SMQL list is the published SOCRadar infrastructure and will rot as the operators rotate; its ip: terms are the durable half, since they match resolved IPs and so still fire on a brand-new domain pointed at the same host. The YARA rule is the anchor meant to survive rotation: it keys on the client-server protocol (steg_ready, /session/reg|check|signal, stego-image.png?sid=), which operators cannot change because they license the client rather than build it. Companion rule Detect_DOUBLECUP_Staged_CacheCommand covers the stage-1 clipboard command separately. Deliberately NOT anchored on *.host.ultaserver.net — that is multi-tenant hosting and trails.csv already lists unrelated tenants there (mythic, apt unc6691), so the apex would drag in other actors; the exact srv641398444 host is used instead. As of 2026-08-04 this hunt matches zero scans in the corpus; it is a tripwire, not a backfill.
References:

Sightings (0)

No sightings recorded yet.