ClickFix cmd/c 'where pow?r?hell.exe' PNG cache extraction chain

Duo Tech@duotech

•updated Aug 6, 2026•4•0•2

Detects the DOUBLECUP ClickFix loader execution chain where cmd.exe uses a 'for /f' loop with 'where pow?r?hell.exe' wildcard lookup, 'findstr' searching for the ZZ1984 marker, and a minimized 'start /min cmd /c' relaunch, consistent with steganographic PNG cache extraction and CountLoader/DeviceManager RAT delivery.