TF-1811900
high
📛 Threat Title
KongTuke: URL that delivers a malware payload https://bradtte.lol/api/v1/verify
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:18 UTC. Last seen: 2026-05-13 21:44:45 UTC. Reporter: monitorsg. Tags: Kongtuke.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
https://bradtte.lol/api/v1/verify
UrlVoid 2 / 35
IOC database
- Type
- url
- Value
https://bradtte.lol/api/v1/verify- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that delivers a malware payload attributed to KongTuke
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference Threatfox IOCs/Threats
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:18 UTC. Last seen: 2026-05-13 21:44:45 UTC. Reporter: monitorsg. Tags: Kongtuke.
Remediations (8)
-
web:cybernews.com
A worker searching for an adblocker ended up installing malware instead after threat actor KongTuke pushed a fake Chrome extension that hijacked the browser, causing repeated crashes and baiting users into running malicious commands.
-
web:cybersecuritynews.com
A sophisticated new cyberattack chain dubbed " KongTuke " has been uncovered by cybersecurity researchers, targeting unsuspecting internet users through compromised legitimate websites. Detailed in a report by Bradley Duncan of Palo Alto Networks' Unit 42 team, this attack leverages malicious scripts and fake CAPTCHA pages to hijack victims' clipboards and potentially install ...
-
web:isc.sans.edu
Introduction Today's diary is an example of KongTuke activity using fake CAPTCHA pages for a ClickFix -style lure. Also known as LandUpdate808 or TAG-124 and described as a sophisticated TDS system, KongTuke has been active since at least May 2024. I keep track of this campaign through the infosec.exchange Mastodon instance, which is mostly information from the @monitorsg profile. With URLscan ...
-
web:thedfirreport.com
The DFIR Report researchers have recently seen this same KongTuke web-inject transitioning to a FileFix variant. This updated delivery mechanism has been observed deploying the PHP variant of the Interlock RAT, which in certain cases has then led to the deployment of the Node.js variant of the Interlock RAT.
-
web:www.csoonline.com
The activity, attributed to a threat cluster Huntress calls KongTuke , involves a fake Chrome extension posing as an ad-blocking tool but ultimately delivering a novel malware payload .
-
web:www.huntress.com
Fake ad blocker crashes your browser, then offers a "fix." Go inside KongTuke's CrashFix campaign, from malicious extension to ModeloRAT for VIP targets.
-
web:www.levelblue.com
A Central Server: The majority of KongTuke's first-stage delivery servers have been observed communicating with a centralized backend over TCP port 443. This server is believed to host the core logic of the traffic distribution system (TDS), which evaluates victim characteristics and determines whether conditions are met to trigger malware ...
-
web:www.trendmicro.com
Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.