#KongTuke
LightNews LightNews
malware-traffic-analysis.net
2026-01-05 (Monday): #KongTuke domain scrroeder[.]com generated #ClickFix script for 144.31.221[.]71, but I didn't get a malware infection when I tried it today.
Injected KongTuke script in page from compromised website. Fake CAPTCHA page from KongTuke domain, scrroeder[.]com. KongTuke's "ClickFix" command injected into the viewer's clipboard. Traffic from the activity filtered in Wireshark. I did not get the malware from this.
January 5, 2026 at 4:50 PM
malware-traffic-analysis.net
2025-10-08 (Wednesday): #Kongtuke campaign fake CAPTCHA page with #ClickFix instructions. Got a full infection chain, this time. A 205MB zip download makes the #pcap take a while to load in Wireshark. Some IOCs and associated malware/artifacts at www.malware-traffic-analysis.net/2025/10/08/i...
Traffic from the infection filtered in Wireshark. Page from a compromised site with injected Kongtuke script. Fake CAPTCHA page, courtesy of the Kongtuke campaign. Following instructions from the Kongtuke campaign's fake CAPTCHA page.
October 9, 2025 at 4:48 AM
bleepingcomputer.com
Initial access broker KongTuke has moved to Microsoft Teams for social engineering attacks, taking as little as five minutes to gain persistent access to corporate networks.
KongTuke hackers now use Microsoft Teams for corporate breaches
Initial access broker KongTuke has moved to Microsoft Teams for social engineering attacks, taking as little as five minutes to gain persistent access to corporate networks.
www.bleepingcomputer.com
May 14, 2026 at 12:12 PM
malware-traffic-analysis.net
2026-09-11 (Friday): Traffic analysis exercise. I generated an infection through #KongTuke #ClickFix activity. Not sure what the malware is, but I'm sharing #pcap as an exercise, while others might find the malware files and other info useful. www.malware-traffic-analysis.net/2026/09/11/i...
Screenshot of the fake verification page used for Kongtuke ClickFix activity
September 12, 2026 at 1:12 AM
campuscodi.risky.biz
Recorded Future has published a profile on TAG-124, a name the company has given to a threat actor running a traffic distribution system (TDS) used by multiple malware operations.

The group is also known as LandUpdate808, 404TDS, KongTuke, Chaya_002.

www.recordedfuture.com/research/tag...
January 30, 2025 at 4:03 PM
malware-traffic-analysis.net
2025-09-03 (Wednesday): #Kongtuke fake CAPTCHA page leads to #ClickFix style script for #LummaStealer

A #pcap of the infection traffic, the associated malware, and IOCs are at www.malware-traffic-analysis.net/2025/09/03/i...
Kongtuke style injected script in page from compromised website Fake CAPTCHA page that performs clipboard hijacking (pastejacking) showing the ClickFix style instructions and malicious script a victim would paste into a Run window or command line terminal. Location of the downloaded zip archive for Lumma Stealer, and the content of that zip archive in the user's AppData\Roaming directory. Traffic from an infection filtered in Wireshark.
September 3, 2025 at 6:13 PM
malware-traffic-analysis.net
026-09-21 (Monday): Some IOCs from today's #KongTuke #ClickFix activity: github.com/malware-traf...
Example of a KongTuke ClickFix fake verification page.
September 21, 2026 at 10:14 PM
malware-traffic-analysis.net
Reposted with correct malware names:

2026-02-02 (Monday) #KongTuke #ClickFix activity leads to #MintsLoader and #GhostWeaver RAT

Today's ClickFix uses the "finger" command, a tactic seen in previous ClickFix activity.

Further details available at www.malware-traffic-analysis.net/2026/02/02/i...
Fake "Verify You Are Human" CAPTCHA page that can appear when viewing a page from a legitimate but compromised website. Text from KongTuke's fake CAPTCHA page injected into the viewer's clipboard, and the CAPTCHA page contains instructions to run the text as a command in Window's Run window. Traffic from the KongTuke activity and resulting infection filtered in Wireshark.
February 3, 2026 at 3:26 AM
malware-traffic-analysis.net
I finished compiling the information for #Kongtuke #ClickFix activity using the finger command on 2025-12-11, and it's now live at www.malware-traffic-analysis.net/2025/12/11/i...

I'd already posted the #SmartApeSG ClickFix activity using finger that same day, so now both are available.
Screenshot of the post with the pcaps, files, and other info from the Kongtuke ClickFix activity using the finger command on 2025-12-11.
December 23, 2025 at 2:33 AM
malware-traffic-analysis.net
2025-01-28 (Tues): A case of web injects--malicious script injected in pages of legit websites. In this example, a site has two instances of injected script, #KongTuke and #SocGholish. A #pcap of the resulting infection, malware samples & more info at www.malware-traffic-analysis.net/2025/01/28/i...
January 29, 2025 at 5:40 AM
0v3rmu53d.bsky.social
#kongtuke
habfan[.]com/7y7hf3j.js
December 9, 2024 at 12:46 PM
ninjaowl.ai
Stealthy Mistic backdoor linked to ransomware access broker KongTuke #cybersecurity #hacking #news #infosec #security #technology #privacy
Stealthy Mistic backdoor linked to ransomware access broker KongTuke
A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors.
www.bleepingcomputer.com
June 24, 2026 at 7:37 PM
I see this as #KongTuke
December 9, 2024 at 8:27 PM
metacurity.com
--ICE surveillance spending hits record high,
--'Mistic' backdoor linked to access broker KongTuke,
--New details on Cisco SD-WAN zero-day intrusions,
--'Edgecution' browser attack escapes the sandbox,
--'Why No Passkeys?' hall of shame emerges, 3/4
June 25, 2026 at 1:44 PM
deepthoughts10.infosec.exchange.ap.brid.gy
Interesting investigative report from ADAMnetworks applicable to those running websites using the Brevo tracker or Sibforms. You may have been serving up ClickFix!

https://adamnet.works/blog/brevo-delivers-kongtuke-clickfix-to-customer-sites/
#cybersecurity
Brevo delivered ClickFix through its own infrastructure
Brevo served KongTuke ClickFix from its own infrastructure. Altered tracker scripts, forms, and unsubscribe pages delivered to customer sites.
adamnet.works
September 16, 2026 at 8:02 PM
infosec.skyfleet.blue
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
thehackernews.com
June 25, 2026 at 9:58 AM
thedfirreport.bsky.social
🚨 New Interlock RAT variant spotted!

Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT).

🔎 thedfirreport.com/2025/07/14/k...

#DFIR #KongTuke #InterlockRAT #FileFix
KongTuke FileFix Leads to New Interlock RAT Variant
Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). This new malware,…
thedfirreport.com
July 14, 2025 at 11:36 AM
handle.invalid
MintsLoader malware delivers StealC info-stealer and BOINC via spam emails. Targets US/European energy & legal sectors. Uses ClickFix/KongTuke techniques & a DGA for C2 comms. StealC avoids infection in several Eastern European countries.#MintsLoaderMalware
January 27, 2025 at 7:47 AM
malware-traffic-analysis.net
Saw this one earlier this month from #Kongtuke: bsky.app/profile/malw...
malware-traffic-analysis.net Brad @malware-traffic-analysis.net · Jul 3
2025-07-03 (Thursday): #FileFix style #ClickFix page from #Kongtuke injected script in page from legitimate site at besthotelshome[.]com.

The mr.d0x article announcing FileFix calls it a ClickFix alternative, but it's really a -variant- of ClickFix. Just using File Manager instead of a Run window.
July 15, 2025 at 1:17 AM
virusbtn.bsky.social
Recorded Future's Insikt Group has identified multi-layered infrastructure linked to a traffic distribution system (TDS) tracked as TAG-124, which overlaps with threat activity clusters known as LandUpdate808, 404TDS, KongTuke and Chaya_002. www.recordedfuture.com/research/tag...
January 31, 2025 at 10:30 AM
technadu.com
💥 Upgraded Interlock RAT via fake CAPTCHA & PowerShell in KongTuke FileFix.

☁️ Uses Cloudflare Tunnel to hide C2
📡 Hardcoded IPs keep it running if blocked
🧠 Steals system info, services, and more

Report:
shorturl.at/3nVzB

#InterlockRAT #KongTuke #Malware #Cybersecurity
Novel Interlock RAT Variant Uncovered in KongTuke FileFix Campaign Relying on Fake CAPTCHAs
July 15, 2025 at 6:56 AM
hacker.at.thenote.app
ClickFix to CrashFix: KongTuke Used Fake Chrome Ad Blocker to Install ModeloRAT

Huntress discovers 'CrashFix,' a new attack by KongTuke hacker group using fake ad blockers to crash browsers and trick office workers into installing ModeloRAT malware.
#hackernews #news
ClickFix to CrashFix: KongTuke Used Fake Chrome Ad Blocker to Install ModeloRAT
Huntress discovers 'CrashFix,' a new attack by KongTuke hacker group using fake ad blockers to crash browsers and trick office workers into installing ModeloRAT malware.
hackread.com
January 21, 2026 at 5:54 PM
bleepingcomputer.com
A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors.
Stealthy Mistic backdoor linked to ransomware access broker KongTuke
A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors.
www.bleepingcomputer.com
June 24, 2026 at 10:42 AM
newssecia.bsky.social
🤖 Mistic: New backdoor by ransomware access broker KongTuke. Targets insurance, education, IT orgs. HTTPS C2, scheduled task persistence. Technical analysis with IoCs.
https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/
June 24, 2026 at 11:39 AM