# ClickFix / KongTuke Clipboard-Hijacking Social-Engineering Technique (MITRE T1204.004) — Fake-CAPTCHA Lures Delivering Infostealers, RATs, and Ransomware

> Independent verification of IOCs cited in a Tier-1 SOC triage methodology article (cybersecuritynews.com) found that the example domain dntds.shop and associated IP 89.190.158.132 are genuinely tracked ClickFix ('paste-and-run' fake-CAPTCHA) malware-delivery infrastructure, corroborated by ANY.RUN sandbox reports, ThreatFox, Gridinsoft, and urlscan.io. ClickFix (MITRE ATT&CK T1204.004, added March 2025) tricks users into copying and pasting an attacker-controlled clipboard payload into the Windows Run dialog, PowerShell, or macOS Terminal, leading to infostealer, RAT, and ransomware-affiliate infections; it is separately weaponized at scale by the KongTuke compromised-WordPress/TDS cluster and by nation-state actors (APT28, MuddyWater).

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1130
- **ID:** TL-2026-1130
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** KongTuke
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The originating source article (cybersecuritynews.com, sponsored by ANY.RUN) is a general Tier-1 SOC alert-triage methodology piece that uses three example indicators — IP 107.170.45.91 and domains dntds.shop and fourdigs.cyou — purely to illustrate an IOC-enrichment workflow, with no campaign attribution given in-article. The HUNT phase correctly flagged this as containing no reportable threat on its face. However, RESEARCH-phase independent pivoting on the cited indicators found that one of them, dntds.shop, is NOT merely illustrative: it is an actively tracked malicious domain. ANY.RUN interactive sandbox analysis rendered a 'malicious activity' verdict against dntds.shop across at least two independent submissions, ThreatFox (abuse.ch, IOC #1780849) tags it 'clickfix' and 'phishing', Gridinsoft assigns it a 1/100 trust score with 19 blacklist detections and phishing-signal flags, and urlscan.io holds a recorded scan of the domain. ANY.RUN's own May-2026 technical write-up on the ClickFix technique separately documents 89.190.158.132 as a destination IP observed during ClickFix sandbox detonations, corroborating that this infrastructure participates in the live ClickFix ecosystem rather than being a random illustrative artifact. The other two indicators from the source article — fourdigs.cyou and 107.170.45.91 — could NOT be independently corroborated as malicious via WebSearch, ThreatFox, or reputation-service lookups at the time of this research; they are retained below as low-confidence/unconfirmed IOCs for completeness and future re-checking, and are NOT treated as confirmed threat infrastructure.

ClickFix (aka 'paste-and-run', 'fake-CAPTCHA', formally MITRE ATT&CK sub-technique T1204.004 'User Execution: Malicious Copy and Paste', added to Enterprise ATT&CK in March 2025) is a clipboard-hijacking social-engineering technique first documented in the wild in March 2024 and now one of the most prevalent initial-execution vectors tracked by the industry (Huntress reported a 631% increase in ClickFix-related incidents between August 2024 and August 2025). Victims land on a page (via phishing link/attachment, malvertising, SEO poisoning, or a compromised legitimate website) that displays a fake reCAPTCHA/Cloudflare Turnstile check, a fake Windows/browser error, or a fake 'verify you are human' prompt. JavaScript on the page silently writes an obfuscated command to the clipboard via the clipboard API; the victim is instructed to press Win+R (or open PowerShell/Terminal on macOS), paste (Ctrl+V), and press Enter, personally executing the attacker's first-stage payload. First-stage payloads are typically short PowerShell one-liners, mshta.exe/rundll32.exe/msbuild.exe/regasm.exe LOLBin invocations, or curl/wget downloaders that retrieve an obfuscated second-stage script, which in turn fetches the final payload — commonly infostealers (Lumma Stealer/LummaC2, Atomic macOS Stealer), loaders (DarkGate, Latrodectus, MintsLoader, Emmenhtal), RATs (AsyncRAT, NetSupport RAT, SectopRAT, Xworm, Quasar RAT, Interlock RAT, modeloRAT), or, via affiliate hand-off, ransomware (Epsilon Red; and via the KongTuke cluster, Rhysida, Interlock, 8Base, Akira, and AlphV/BlackCat).

A distinct, separately-documented ClickFix delivery cluster tracked by Trend Micro under the name 'KongTuke' compromises WordPress sites at scale (300+ sites and 40+ traffic-distribution-system domains observed), injecting malicious JavaScript (e.g., served from foodgefy.com / 162.33.178.171) that redirects visitors into fake-CAPTCHA ClickFix pages. KongTuke's chain has been observed delivering the Python-based modeloRAT and ultimately handing off infected hosts to multiple ransomware affiliate groups. Domains nitzschi.com and windlrr.com are separately tagged to the KongTuke cluster on ThreatFox. ClickFix has also been weaponized by nation-state actors independent of KongTuke or the dntds.shop cluster: Group-IB documents APT28 using ClickFix against Ukrainian government targets and MuddyWater using localized ClickFix variants against Armenian organizations — no specific network IOCs for these nation-state operations were available in the sources reviewed, so none are asserted below.

Because ClickFix relies entirely on tricking a human into self-executing a command — not on any software vulnerability — there is no vendor patch; defense depends on user-awareness training, blocking known landing-page infrastructure, and behavioral/registry-based detection (RunMRU and TypedPaths registry-key monitoring, PowerShell Script Block Logging, and process-lineage rules for browser/explorer.exe spawning conhost.exe or scripting interpreters).

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1608 Stage Capabilities
- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1127 Trusted Developer Utilities Proxy Execution
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Sources

- [False Positive or First Sign of a Breach? How Tier-1 SOC Analysts Can Tell the Difference Faster](https://cybersecuritynews.com/false-positive-or-first-sign-of-a-breach-how-tier-1-soc-analysts-can-tell-the-difference-faster/)
- [ANY.RUN Malware Analysis: dntds.shop (malicious activity verdict)](https://any.run/report/4e64a4ac232cc323cc8e615ab97f003f45c2413731c49b0db4d42f9532fb0424/a903f054-7426-4655-b33d-1355c2de4cd1)
- [ANY.RUN Malware Analysis: dntds.shop/jsrepo (malicious activity verdict)](https://any.run/report/53fb095537ef1ea1249f098ea56f7fd763777c1780c18bfdd98f61ee5d740c02/06cba729-974b-4cca-baf1-2bcd917f33bb)
- [ThreatFox IOC Database - dntds.shop (ClickFix / phishing tags)](https://threatfox.abuse.ch/ioc/1780849/)
- [Dntds.shop Review: Suspicious Website, Blacklisted by Security Vendors](https://gridinsoft.com/online-virus-scanner/url/dntds-shop)
- [urlscan.io scan result: dntds.shop](https://urlscan.io/result/019eacde-856d-7064-bdce-d088ee31dc41/)
- [ClickFix: Technique Overview](https://medium.com/@anyrun/clickfix-technique-overview-89977d1882b4)
- [ClickFix Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/clickfix/)
- [Think before you ClickFix: Analyzing the ClickFix social engineering technique](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [ClickFix Attack: Variants, Detection & How It Works (Don't Sweat ClickFix Techniques)](https://www.huntress.com/blog/dont-sweat-clickfix-techniques)
- [ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims](https://www.group-ib.com/blog/clickfix-the-social-engineering-technique-hackers-use-to-manipulate-victims/)
- [Through the Lens of MDR: Analysis of KongTuke's ClickFix Abuse of Compromised WordPress Sites](https://www.trendmicro.com/en_us/research/26/c/kongtuke-clickfix-abuse-of-compromised-wordpress-sites.html)
- [User Execution: Malicious Copy and Paste, Sub-technique T1204.004 - Enterprise | MITRE ATT&CK](https://attack.mitre.org/techniques/T1204/004/)
- [700+ education and tech websites hijacked in huge ClickFix malware campaign](https://www.malwarebytes.com/blog/bugs/2026/05/700-education-and-tech-websites-hijacked-in-huge-clickfix-malware-campaign)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1130