TF-1811901
high
📛 Threat Title
KongTuke: URL that delivers a malware payload https://bradtte.lol/api/v1/status
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:19 UTC. Last seen: 2026-05-13 21:44:46 UTC. Reporter: monitorsg. Tags: Kongtuke.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
https://bradtte.lol/api/v1/status
UrlVoid 2 / 35
IOC database
- Type
- url
- Value
https://bradtte.lol/api/v1/status- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that delivers a malware payload attributed to KongTuke
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference Threatfox IOCs/Threats
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:19 UTC. Last seen: 2026-05-13 21:44:46 UTC. Reporter: monitorsg. Tags: Kongtuke.
Remediations (8)
-
web:cybersecuritynews.com
A sophisticated new cyberattack chain dubbed " KongTuke " has been uncovered by cybersecurity researchers, targeting unsuspecting internet users through compromised legitimate websites. Detailed in a report by Bradley Duncan of Palo Alto Networks' Unit 42 team, this attack leverages malicious scripts and fake CAPTCHA pages to hijack victims' clipboards and potentially install ...
-
web:gbhackers.com
Threat intelligence researchers at Huntress have uncovered a sophisticated browser extension campaign orchestrated by the KongTuke threat actor group.
-
web:thedfirreport.com
The DFIR Report researchers have recently seen this same KongTuke web-inject transitioning to a FileFix variant. This updated delivery mechanism has been observed deploying the PHP variant of the Interlock RAT, which in certain cases has then led to the deployment of the Node.js variant of the Interlock RAT.
-
web:www.broadcom.com
Huntress security analysts identified a series of recent activities attributed to the threat actor known as KongTuke . The attackers have been employing malicious browser extensions to generate fake security alerts, claiming the browser halted unexpectedly and urging the user to initiate a "scan" for remediation .
-
web:www.csoonline.com
The activity, attributed to a threat cluster Huntress calls KongTuke , involves a fake Chrome extension posing as an ad-blocking tool but ultimately delivering a novel malware payload .
-
web:www.huntress.com
Fake ad blocker crashes your browser, then offers a "fix." Go inside KongTuke's CrashFix campaign, from malicious extension to ModeloRAT for VIP targets.
-
web:www.levelblue.com
A Central Server: The majority of KongTuke's first-stage delivery servers have been observed communicating with a centralized backend over TCP port 443. This server is believed to host the core logic of the traffic distribution system (TDS), which evaluates victim characteristics and determines whether conditions are met to trigger malware ...
-
web:www.trendmicro.com
Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.