Kongtuke

KongTuke is a traffic distribution system and malware delivery framework first observed in 2024 that is primarily associated with compromised WordPress websites and ClickFix-style social engineering. It injects malicious JavaScript into legitimate sites, redirects visitors through staged infrastructure, and presents fake verification or CAPTCHA lures that coerce users into executing attacker-supplied commands. In 2025 and 2026, KongTuke activity was repeatedly linked to paste-and-run and FileFix variants, as well as to ClickFix chains that copied commands to the clipboard for manual execution on victim systems.

KongTuke has been used to deliver a range of downstream payloads, including loaders, remote access trojans, Node.js backdoors, stealers, and ransomware-associated tooling. Reported follow-on malware families include MintsLoader, GhostWeaver RAT, WARMCOOKIE, D3F@ck Loader, Mocha Manakin, Interlock, and Rhysida. Some observed chains also used DLL sideloading with legitimate signed Mozilla Firefox binaries, loading Rust-based malicious DLLs that acted as an initial loader, persistence component, and primary command-and-control implant.

The framework emphasizes resilient and flexible infrastructure. Observed campaigns used staged JavaScript delivery, gateway and clipboard handling, domain rotation, and in some cases blockchain-based retrieval of command-and-control configuration through Polygon smart contracts. Separate reporting also describes a domain generation algorithm used by KongTuke implants to derive command-and-control domains from themed wordlists and multiple top-level domains. Communications have been observed over HTTPS with regular beaconing behavior.

KongTuke is best understood as an initial-access and delivery ecosystem rather than a single monolithic payload. Its core function is to move victims from compromised web content or social-engineering lures into execution of additional malware, while supporting persistence and command-and-control in some variants. Activity associated with KongTuke has been tied to fake Cloudflare or browser-verification pages, fake CAPTCHA prompts, and compromised websites across broad victim populations rather than a single vertical. Reporting has also linked some KongTuke delivery chains to operations targeting Ukraine-related entities, although attribution remains campaign-specific rather than universally applicable to all KongTuke activity.