This New Malware Hides in Your Browser's Cache Images

Emily Davis · 2026-08-03

You probably don't think twice about the images your browser caches as you surf the web. They're just tiny files that help pages load faster, right? Well, a new threat called DOUBLECUP is turning that everyday convenience into a clever hiding spot for malware. It's a Russian loader-as-a-service that's targeting both Windows and macOS users, and it's worth understanding how it works. ### The ClickFix Trick: Making You the Attacker's Helper Here's the scary part: DOUBLECUP doesn't rely on you downloading a sketchy file. Instead, it uses something called a ClickFix attack. You've probably seen those fake CAPTCHA prompts that tell you to verify you're human by pressing a key combination or running a command. That's the trick. The attacker gets you to paste a malicious command into your own terminal or run a PowerShell script, all while you think you're just proving you're not a bot. It's social engineering at its finest, and it's incredibly effective because it makes you an active participant in your own compromise. ### Hiding Malware in PNG Images: A Sneaky New Tactic Once you've been tricked, DOUBLECUP gets to work. It doesn't just drop a payload on your disk where antivirus software can find it. Instead, it hides malicious code inside PNG images that are already cached by your browser. Think about it: your browser has a folder full of images it's saved from websites you've visited. Security tools often skip scanning these cached files because they're considered harmless. DOUBLECUP exploits that blind spot. It plants the malicious code within those cached images, making it much harder for traditional security software to detect. ### What Happens After the Infection? The ultimate goal is to deliver a couple of nasty payloads. On both Windows and macOS, it installs something called CountLoader. This is a downloader that can pull in additional malware, basically opening the floodgates for whatever the attacker wants to send. But on Windows systems, there's an even more concerning payload: a brand new remote access trojan (RAT) named DeviceManager. This gives the attacker full control over your machine. They can move files around, capture keystrokes, run commands, and essentially do whatever they want, all while you're none the wiser. ### Why This Matters for Your Security Posture You might be thinking, "I'm careful, I don't click on random links." But that's not enough anymore. These attacks are becoming more sophisticated, and they're targeting the very tools we use every day. The fact that DOUBLECUP is a service means that even less-skilled cybercriminals can rent this infrastructure and launch these attacks. It lowers the barrier to entry, which means we'll likely see more of these attacks in the wild. ### Practical Steps to Protect Yourself So, what can you do? Here are a few things that can make a real difference: - **Think before you copy-paste**: If a website asks you to run a command or press a specific key combination to verify you're human, stop. Legitimate CAPTCHAs don't work that way. - **Clear your browser cache regularly**: This isn't a silver bullet, but it can help remove any potentially malicious files that might be lurking there. - **Keep your software updated**: Make sure your operating system and browser are patched. These updates often fix security flaws that attackers exploit. - **Use a reputable security suite**: Look for tools that offer real-time protection and can detect unusual behavior, not just known malware signatures. ### The Bottom Line DOUBLECUP is a reminder that the threat landscape is constantly evolving. Attackers are finding new, creative ways to hide their code and trick us into letting them in. Staying informed and skeptical is your best defense. If something feels off, it probably is. Trust that instinct, and always think twice before you let a website tell you to run a command.