KongTukeMalware
- js.landupdate808
Kongtuke is a sophisticated TDS system that was initially discovered around May 2024. Making use of compromised CMS Websites, Kongtuke redirects website visitors through a multi-stage infection process ultimately leading to device infection. Initially using fake Update lures, it started to use FakeCaptcha lures at the beginning of 2025.From MISP Galaxy
Last reported 29 days ago, by Risky Business News7 reports
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1684Social Engineering
“The cycle repeats until the user either falls for the social engineering or removes the extension.”
- T1204.004Malicious Copy and Paste
“…ites to deliver malware via drive-by download techniques, often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (aka paste and run, ClickFix, fakeCAPTCHA).”
- T1036Masquerading
“In July 2026 we most frequently observed it masquerading as PDF readers.”
- T1053.005Scheduled Task
“It also establishes persistence by creating a scheduled task named “SoftwareProtection,” designed to blend in as legitimate software protection service.”
- T1055Process Injection
“If successful, the decrypted CastleLoader binary is injected into python.exe using process injection via a shellcode-based loader.”
- T1056.001Keylogging
“Remote access trojan with several capabilities including keylogging, screen capturing, and remote shell access”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“KongTuke spreads SystemBC: According to a new report, the KongTuke e-crime group is now spreading the SystemBC RAT via ClickFix lures.”
-
Exvicy: A Copycat of the ErrTraffic Malware Distribution Framework“It became a leading competition among ClickFix distribution clusters, alongside ClearFake, KongTuke, SmartApeSG, and IClickFix.”
-
Intelligence Insights: August 2026“KongTuke”
-
Intelligence Insights: July 2026“Returning to the top 10 in 2nd is KongTuke, a traffic distribution system (TDS) first observed in 2024 that uses compromised WordPress sites to deploy malicious code that may lead to malware.”
-
Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites“Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites”
-
Dissecting CrashFix: KongTuke's New Toy“Dissecting CrashFix: KongTuke's New Toy”
-
KongTuke FileFix Leads to New Interlock RAT Variant“KongTuke FileFix Leads to New Interlock RAT Variant”
Indicators in its reports
named in the reports above- 158.247.252[.]178in 2 reports
- 170.168.103[.]208in 2 reports
- third-party[.]comin 1 report
- gl1nto.spiintforge[.]ruin 1 report
- reeemso.forwardbox.co[.]ukin 1 report
- chainlist[.]orgin 1 report
- ai-scan[.]digitalin 1 report
- bg-transparency[.]onlinein 1 report
- linkedall[.]orgin 1 report
- golinked[.]netin 1 report
- indeed-jobs[.]netin 1 report
- cheeshomireciple[.]comin 1 report
- hxxps://mirtona[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc12in 1 report
- mirtona[.]comin 1 report
- 104.194.9[.]227in 1 report
- hxxp://deadly-programming-attorneys-our.trycloudflare[.]comin 1 report
- deadly-programming-attorneys-our.trycloudflare[.]comin 1 report
- result[.]propertiesin 1 report
- 28a9982cf2b4fc53…fa0ca7f7b7d3in 1 report
- 8afd6c0636c5d70a…d939377727b0in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.