TF-1811899
high
📛 Threat Title
KongTuke: URL that delivers a malware payload https://bradtte.lol/api/v1/session
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:17 UTC. Last seen: 2026-05-13 21:44:43 UTC. Reporter: monitorsg. Tags: Kongtuke.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
https://bradtte.lol/api/v1/session
UrlVoid 2 / 35
IOC database
- Type
- url
- Value
https://bradtte.lol/api/v1/session- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that delivers a malware payload attributed to KongTuke
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference Threatfox IOCs/Threats
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:17 UTC. Last seen: 2026-05-13 21:44:43 UTC. Reporter: monitorsg. Tags: Kongtuke.
Remediations (10)
-
web:community.gurucul.com
KongTuke involves an injected script that causes associated websites to display fake "verify you are human" pages. These deceptive pages load the victim's Windows clipboard with a malicious PowerShell script and provide detailed instructions, urging victims to paste and execute the script in a Run window. This tactic is part of a campaign commonly tracked as # KongTuke .
-
web:cybersecuritynews.com
CrashFix malware uses a fake Chrome ad-blocker to crash browsers, tricking users into running dangerous commands after forced frustration.
-
web:gbhackers.com
Threat intelligence researchers at Huntress have uncovered a sophisticated browser extension campaign orchestrated by the KongTuke threat actor group.
-
web:hoploninfosec.com
The KongTuke campaign exemplifies the innovative and multifaceted approaches that cybercriminals are using today. By exploiting vulnerabilities in trusted websites and manipulating user behavior through deceptive prompts, attackers are able to deliver highly sophisticated malware that can remain undetected for extended periods.
-
web:smartermsp.com
Security researchers have uncovered an active malvertising campaign abusing a fake ad‑blocking extension that intentionally crashes Google Chrome and Microsoft Edge to trick users into executing malicious commands—a new evolution of the ClickFix technique known as "CrashFix." Read the Cybersecurity Threat Advisory now to reduce your risk.
-
web:thehackernews.com
Researchers uncovered a CrashFix campaign where a fake Chrome ad blocker crashes browsers to trick users into installing the ModeloRAT malware .
-
web:www.csoonline.com
The activity, attributed to a threat cluster Huntress calls KongTuke , involves a fake Chrome extension posing as an ad-blocking tool but ultimately delivering a novel malware payload .
-
web:www.huntress.com
Fake ad blocker crashes your browser, then offers a "fix." Go inside KongTuke's CrashFix campaign, from malicious extension to ModeloRAT for VIP targets.
-
web:www.microsoft.com
The ZIP archive contains a Python-based payload (udp.pyw) along with a renamed Python interpreter (run.exe), and establishes persistence by creating a scheduled task named "SoftwareProtection," designed to blend in as legitimate software protection service, and which repeatedly executes the malicious Python payload every 5 minutes.
-
web:www.trendmicro.com
Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.