Known malicious kitcriticalphishing
DOUBLECUP ClickFix Loader-as-a-Service (CountLoader / DeviceManager RAT)
family: doublecup-clickfix-laas
Rented ClickFix delivery service active since June 2026. Operators embed a fixed frontend snippet into their own lure pages; DOUBLECUP hosts the steganographic PNG, the session endpoints and the encryption keys. Stage 1 is a clipboard command that finds the cached PNG by exact file size and carves an embedded script out of it, so nothing is downloaded at execution time. Stage 2 derives its decryption key from the victim's public IP, meaning the payload will not decrypt in an offline sandbox. Observed payloads: CountLoader 4.5p (Windows PowerShell and macOS Mach-O) and DeviceManager, a Python RAT that resolves C2 from Ethereum/Polygon smart contracts (EtherHiding) and tunnels over DNS using microsoft.com as a decoy apex.
Anchors
YARA ruleDetect_DOUBLECUP_Loader_Frontend
SMQL queryrun
ip:213.139.77.109 OR ip:80.96.109.229 OR ip:167.148.201.131 OR ip:89.124.117.12 OR ip:103.22.137.227 OR ip:67.219.107.181 OR ip:146.70.124.154 OR ip:91.92.240.100 OR domain:srv641398444.host.ultaserver.net OR domain:*nxtdrcliam.siteProvenance
Added: 2026-08-04 08:51
Two anchors, deliberately. The query lists the infrastructure SOCRadar published and will go stale as the operators rotate; its IP terms are the durable half, because they match resolved IPs and so still fire on a brand-new domain pointed at the same host. The YARA rule is meant to survive rotation: it keys on the client-server protocol (steg_ready, /session/reg|check|signal, stego-image.png?sid=), which operators cannot change because they license the client rather than build it. The companion rule Detect_DOUBLECUP_Staged_CacheCommand covers the stage-1 clipboard command. Deliberately NOT anchored on *.host.ultaserver.net: that is multi-tenant hosting where public threat lists already attribute other tenants to unrelated actors, so the exact srv641398444 host is used instead. No matches as of 2026-08-04: this is a tripwire, not a backfill.
Sightings (1)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| examcanvas.com | 0c5b3ba4… | — | query | 2026-09-13 02:50 |