TF-MAL-js.kongtuke
📛 Threat Title
Malware family: KongTuke
Description
ThreatFox malware family `js.kongtuke`. Printable name: KongTuke. Aliases: TAG-124,js.LandUpdate808.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
js.kongtuke
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.kongtuke
IOC database
- Type
- domain
- Value
js.kongtuke- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-js.kongtuke
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/js.kongtuke
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:aviatrix.ai
In November 2025, KongTuke used fake CAPTCHA lures and PowerShell to deploy persistent Python-based malware through compromised sites, evading detection.
-
web:cert-mu.govmu.org
Researchers from The DFIR Report, collaborating with Proofpoint, have uncovered a resilient PHP-based variant of the Interlock ransomware group's remote access trojan (RAT), marking a significant evolution from the previously documented JavaScript-driven NodeSnake. This adaptation, observed in campaigns linked to the LandUpdate808 threat cluster also known as KongTuke has been active since ...
-
web:cybersecuritynews.com
A sophisticated new cyberattack chain dubbed " KongTuke " has been uncovered by cybersecurity researchers, targeting unsuspecting internet users through compromised legitimate websites. Detailed in a report by Bradley Duncan of Palo Alto Networks' Unit 42 team, this attack leverages malicious scripts and fake CAPTCHA pages to hijack victims' clipboards and potentially install ...
-
web:gurucul.com
MDR analysis reveals how KongTuke uses ClickFix to abuse compromised WordPress sites. Learn how SIEM and behavioral analytics detect identity-based threats.
-
web:isc.sans.edu
Shown above: Fake CAPTCHA page from a legitimate site with KongTuke -injected script, with the ClickFix style instructions and malicious command. The CAPTCHA page hijacks the clipboard, injecting text for a malicious command to download and run PowerShell script. Potential victims would read the instructions and paste this command into Run window.
-
web:thedfirreport.com
This new malware , a shift from the previously identified JavaScript-based Interlock RAT (aka NodeSnake), uses PHP and is being used in a widespread campaign. Since May 2025, activity related to the Interlock RAT has been observed in connection with the LandUpdate808 (aka KongTuke ) web-inject threat clusters.
-
web:www.huntress.com
Fake ad blocker crashes your browser, then offers a "fix." Go inside KongTuke's CrashFix campaign, from malicious extension to ModeloRAT for VIP targets.
-
web:www.levelblue.com
KongTuke's activity overlaps with several known threat activity clusters, including LandUpdate808, TAG-124, and Chaya_002. KongTuke , however, is not a stand-alone organization and is classified as a sub-group of the "FAKEUPDATES" malware ecosystem.
-
web:www.malware-traffic-analysis.net
2026-01-08 (THURSDAY): KONGTUKE CLICKFIX ACTIVITY NOTES: - This was done with a client on a domain controller in my lab, using the domain furtherningthemagic [.]com.
-
web:www.trendmicro.com
Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.