Kongtuke

KongTuke is a malicious traffic distribution system active since at least 2024 that compromises legitimate WordPress sites and injects JavaScript to redirect visitors into malware delivery chains. It is also tracked under aliases including 404 TDS, Chaya_002, LandUpdate808, TAG-124, and js.kongtuke. Rather than being a single end-stage payload, KongTuke functions as an intermediary delivery framework that profiles victims, routes traffic, and presents social-engineering lures that lead users to execute attacker-supplied commands or retrieve additional malware.

Observed KongTuke activity heavily relies on ClickFix and related paste-and-run techniques, including fake CAPTCHA and FileFix variants. Victims visiting compromised websites are shown verification-style prompts that covertly place commands in the clipboard and instruct the user to paste and run them through Windows interfaces. KongTuke has also been observed using injected scripts on compromised sites to stage multi-step delivery flows involving tokening, gateway logic, clipboard manipulation, and subsequent payload download.

The infrastructure and delivery logic are designed for resilience and evasion. In one documented variant, the malicious JavaScript retrieved command-and-control configuration dynamically from a Polygon blockchain smart contract instead of hardcoding infrastructure, enabling rapid backend rotation and complicating static detection. KongTuke has been associated with fake Cloudflare-style verification pages and other browser-verification lures intended to make the interaction appear legitimate.

KongTuke has been linked to delivery of multiple downstream malware families, including MintsLoader, WARMCOOKIE, D3F@ck Loader, Mocha Manakin, Node.js backdoors, remote-access tooling, and ransomware such as Rhysida and Interlock. Reported follow-on payload behavior has included host profiling, remote access, tunneling through SOCKS5 proxies, scheduled-task persistence, and staged archive delivery. KongTuke delivery chains have also overlapped with activity involving GREYVIBE, and some reporting attributes the broader TDS activity to clusters tracked as TAG-124.

The malware primarily targets Windows users through browser-based social engineering delivered from compromised WordPress sites. Its role in the intrusion lifecycle is initial access and payload delivery, with strong emphasis on defense evasion through dynamic infrastructure, compromised legitimate websites, and user-assisted execution.