DOUBLECUP turns ClickFix into cached PNG delivery for CountLoader and DeviceManager

DOUBLECUP is using fake CRM pages and ClickFix instructions to hide malware inside PNG files cached by browsers. The loader delivers CountLoader or the newly documented DeviceManager RAT, which decrypts payloads in memory and can use blockchain-resolved command-and-control infrastructure.
Source

👉@sysadminoff

https://4sysops.com/archives/doublecup-turns-clickfix-into-cached-png-delivery-for-countloader-and-devicemanager/