Executive Summary
Two sophisticated, newly discovered cyber threat campaigns—dubbed "Pass-ta-Key" and "DOUBLECUP"—are actively targeting enterprise environments by bypassing traditional multi-factor authentication (MFA) and endpoint security controls. "Pass-ta-Key" represents a novel attack vector that allows malware on compromised Windows endpoints to hijack Google Password Manager synced passkeys and extract private keys. Simultaneously, the "DOUBLECUP" loader-as-a-service utilizes ClickFix social engineering to conceal malicious code inside PNG images cached in victim browser directories, delivering infostealers and remote access trojans.
Deep-Dive Technical Analysis
1. Pass-ta-Key Attacks: Hijacking Google Synced Passkeys
Passkeys built on the WebAuthn and FIDO2 standards have been widely adopted as passwordless, phishing-resistant authentication mechanisms. However, security researchers have uncovered three distinct attack techniques ("Pass-ta-Key") that allow local endpoint malware to undermine synced passkeys:
* Session Hijacking & Key Extraction: Malware operating with local user privileges on a compromised Windows machine accesses Google Password Manager’s synced passkey vault.
* Passkey Reuse & Verification Bypass: The malware intercepts active browser session tokens and extracts raw private keys or relays WebAuthn assertions directly.
* MFA Bypass: Because WebAuthn assertions are generated from the trusted, synced account, attackers can authenticate into corporate portals from secondary devices without triggering user verification or secondary MFA prompts.
2. DOUBLECUP ClickFix Campaign: Hiding Malware in Browser Image Caches
The "DOUBLECUP" campaign operates as a Loader-as-a-Service (LaaS) utilizing "ClickFix" social engineering prompts (fake human-verification or browser-error popups instructing users to copy and paste PowerShell scripts into cmd or Run dialogs).
* Stealthy Cache Staging: DOUBLECUP downloads seemingly benign .png image files into the victim's local web browser cache directory (AppData\Local\Google\Chrome\User Data\Default\Cache).
* Steganographic Decoding: A lightweight obfuscated script extracts hidden, encrypted payload bytes embedded within the PNG image structure.
* Dual-OS Payload Delivery: Upon assembly, DOUBLECUP drops CountLoader to deliver infostealers on Windows and macOS, and deploys DeviceManager RAT on Windows host systems to establish persistent remote access.
Industry Impact & Recommended Mitigations
These dual threat vectors demonstrate that threat actors are rapidly adapting to post-password security architectures by exploiting endpoint local execution privileges and browser cache persistence mechanisms.
Actionable Mitigations
1. Hardware-Bound Passkeys: Mandate hardware security keys (e.g., YubiKeys or TPM-bound device passkeys) for critical enterprise systems rather than cloud-synced passkey vaults, preventing private keys from leaving the physical device.
2. Restrict PowerShell Execution: Block standard users from executing unassigned PowerShell scripts or pasting clipboard contents directly into system execution dialogs via Group Policy (GPO) or EDR rules.
3. Browser Cache & Directory Monitoring: Configure Endpoint Detection and Response (EDR) agents to detect anomalous binary extraction from browser cache folders (User Data\Default\Cache).
4. Passkey Re-Authentication Policies: Enforce step-up biometric re-authentication for sensitive cloud application logins to neutralize session-relayed passkey assertions.