This Sneaky Malware Hides Inside Your Browser's Image Cache

Robert Moore · 2026-08-03

You know how your browser stores images to load pages faster? That little cache that makes everything feel snappy? Well, a new threat is exploiting that exact feature to slip malware past your defenses. It's called DOUBLECUP, and it's a Russian loader-as-a-service that's been making the rounds with a particularly clever trick. Instead of trying to sneak malicious files through email attachments or sketchy downloads, DOUBLECUP uses something called ClickFix attacks. The idea is simple: you visit a page, you see a fake error, and you're told to click a button or run a command to 'fix' it. That click is all it takes. The malware then hides its payload inside PNG images that your browser naturally caches as you browse. It's hiding in plain sight, right where you'd least expect it. ### The ClickFix Attack: A Quick Breakdown If you haven't heard of ClickFix, it's one of those social engineering tricks that just keeps working. The attacker sets up a page that mimics a CAPTCHA or a system error. You're prompted to copy a command into your terminal or press a key combination to verify you're human. But that command is actually the first stage of the infection. - The fake error looks legitimate, often mimicking Windows or browser alerts. - The command you're asked to run downloads and executes a script. - That script pulls the next stage from a cached image, making it harder to detect. It's a nasty chain, and it's surprisingly effective because it relies on you, the user, to do the heavy lifting. ### What Does DOUBLECUP Actually Deliver? Once the infection chain starts, DOUBLECUP doesn't just stop at one payload. It's a delivery service, so it can push whatever the customer wants. In this campaign, researchers spotted two main pieces of malware being dropped. First, there's CountLoader, which targets both Windows and macOS systems. This one is a classic loader, designed to establish a foothold and bring in additional malware. Second, there's a new remote access trojan (RAT) called DeviceManager, which is currently aimed only at Windows. This RAT gives the attacker full control over your machine, letting them snoop around, steal data, or use your system for other shady activities. The fact that both platforms are targeted is a reminder that Mac users aren't immune to these threats. It's a common misconception that macOS is bulletproof, but that's simply not true anymore. ### Why Hiding in the Cache Is So Sneaky Security tools are getting better at scanning files as they arrive. But the cache is a trusted area. It's where your browser stores images and scripts it thinks are safe. By embedding malicious code into a PNG file and letting the browser cache it, the attackers can bypass some of those initial checks. Think of it like hiding a spare key under a fake rock in your garden. The security camera is watching the front door, but the key is just sitting there, looking innocent. When the malware needs to access that key, it simply retrieves it from the cache, and the security system doesn't blink an eye. ### How to Protect Yourself So, what can you do about this? The good news is that a few simple habits can go a long way. - **Be suspicious of error messages.** If a website tells you to run a command or copy-paste text into a terminal, stop. Legitimate sites never ask you to do that. - **Keep your browser updated.** Updates often include patches for known vulnerabilities. - **Use a reliable antivirus or endpoint protection.** Modern tools can detect suspicious behavior, even if the file itself looks clean. - **Consider an antidetect browser for sensitive work.** If you're juggling multiple accounts or doing privacy-critical tasks, an antidetect browser can add an extra layer of separation and control. ### The Bottom Line DOUBLECUP is another reminder that the threat landscape is constantly evolving. Attackers are getting more creative, and they're finding new ways to exploit the tools we use every day. The best defense is a combination of good security software and a healthy dose of skepticism. If something feels off, it probably is. Trust your gut, and don't click that 'fix' button.