#kongtuke

Detected #KongTuke infection chain Compromised site --> caapman[.]me/ql8tbzbg.js (ClickFucker) --> caapman[.]me/api/v1/session (token) --> caapman[.]me/api/v1/verify (gateway) --> caapman[.]me/api/v1/status (clipboard) --> portalguard7797[.]com/b (cmd) --> portalguard7797[.]com/ue (cmd) 6389cfc4b6ac7726bed2b829bb320692528682276f292a1e39adfe373c15c94d b df2a191a0994bb1a7068b6653198b4fb2a57cabd572b9e1acffbc792dfed1a90 ue

Detected #KongTuke infection chain Compromised site --> griffihhs[.]click/q2hfsow4.js (ClickFucker) --> griffihhs[.]click/api/v1/session (token) --> griffihhs[.]click/api/v1/verify (gateway) --> griffihhs[.]click/api/v1/status (clipboard) --> tom-yy[.]top/f (powershell) 24d35d5da1d2f76292de0c6bc406fcc1108055eaaa0b54952cf8d9a49d0aea3e f

Detected #KongTuke infection chain Compromised site --> phiplips[.]click/l1hdpx7b.js (ClickFucker) --> phiplips[.]click/api/v1/session (token) --> phiplips[.]click/api/v1/verify (gateway) --> phiplips[.]click/api/v1/status (clipboard) --> tommy-eg[.]top/f (powershell) 372fa1524bcf4bb658b87d830071be38826beafb3311cd73c3d0314433233a5c f

Detected #KongTuke infection chain Compromised site --> chaphan[.]click/jkg4oml2.js (ClickFucker) --> chaphan[.]click/api/v1/session (token) --> chaphan[.]click/api/v1/verify (gateway) --> chaphan[.]click/api/v1/status (clipboard) --> tommy-er[.]top/f (powershell) 61351d869940b9875400bf4ebd1bdc29f972813473a823acc85db242487212bc f

Detected #KongTuke infection chain Compromised site --> bauabach[.]lol/zcfo2l6c.js (ClickFucker) --> bauabach[.]lol/api/v1/session (token) --> bauabach[.]lol/api/v1/verify (gateway) --> bauabach[.]lol/api/v1/status (clipboard) --> globalupdate6711[.]com/update/package (tar) c5a3d94cb6b4be539b68401e2fbd8008740d230109ee13a5b3b863f8e2d935c1 package

Detected #KongTuke infection chain Compromised site --> marshalh[.]icu/c9lg2uqb.js (ClickFucker) --> marshalh[.]icu/api/v1/session (token) --> marshalh[.]icu/api/v1/verify (gateway) --> marshalh[.]icu/api/v1/status (clipboard) --> hosthex9101[.]com/update/package (tar) 1cec90906b40fa7e29f0cd531d3bbcfc19f6e03fd99b5c41b5dbce8270652460 package

Detected #KongTuke infection chain Compromised site --> bouoher[.]lol/jyuf6cei.js (ClickFucker) --> bouoher[.]lol/api/v1/session (token) --> bouoher[.]lol/api/v1/verify (gateway) --> bouoher[.]lol/api/v1/status (clipboard) --> tommy-ee[.]top/f (powershell) bd15d8e2239a293d77a7fc1e9b38c3461c79069273d7d7c17ae1e7ca4ab82156 f

Detected #KongTuke infection chain Compromised site --> barringer[.]click/dsdchzzv.js (ClickFucker) --> barringer[.]click/api/v1/session (token) --> barringer[.]click/api/v1/verify (gateway) --> barringer[.]click/api/v1/status (clipboard) --> tommy-bb[.]lol/f (powershell) 489f30e58a4bd38d0707c7123967c8d62c35f80c0393f5d05d4c7ba3b12ae22d f

Detected #KongTuke infection chain Compromised site --> meduurst[.]space/vtyzese3.js (ClickFucker) --> meduurst[.]space/api/v1/session (token) --> meduurst[.]space/api/v1/verify (gateway) --> meduurst[.]space/api/v1/status (clipboard) --> nodemetrics9095[.]com/update/package (tar) a1e14e2b06dc859053cb63cfa9e76b4ef43540a35d736dc9fb1c39986bf67654 package

Detected #KongTuke infection chain Compromised site --> oosterhout[.]click/82234daz.js (ClickFucker) --> oosterhout[.]click/api/v1/session (token) --> oosterhout[.]click/api/v1/verify (gateway) --> oosterhout[.]click/api/v1/status (clipboard) --> tommy-aa[.]lol/f (powershell) 64242dabcf2551d3aeab1ce9e22ae2e8508726d20ec3b347f783e5fa7216423c f

Detected #KongTuke infection chain Compromised site --> ritchie[.]click/frxhgs71.js (ClickFucker) --> ritchie[.]click/api/v1/session (token) --> ritchie[.]click/api/v1/verify (gateway) --> ritchie[.]click/api/v1/status (clipboard)

Detected #KongTuke infection chain Compromised site --> ritchie[.]click/ksbfgehn.js (ClickFucker) --> ritchie[.]click/api/v1/session (token) --> ritchie[.]click/api/v1/verify (gateway) --> ritchie[.]click/api/v1/status (clipboard) --> f-codebase[.]lol/f (powershell) a6846acd9c5b16a128b68f45f9af8ce2c9e10fa73a390c53e8b4546862a14222 f

Detected #KongTuke infection chain Compromised site --> ritchie[.]click/bgmmbr3x.js (ClickFucker) --> ritchie[.]click/api/v1/session (token) --> ritchie[.]click/api/v1/verify (gateway) --> ritchie[.]click/api/v1/status (clipboard)

Detected #KongTuke infection chain Compromised site --> thibahlt[.]lol/file.js (ClickFucker) --> thibahlt[.]lol/api/v1/session (token) --> thibahlt[.]lol/api/v1/verify (gateway) --> thibahlt[.]lol/api/v1/status (clipboard)

Detected #KongTuke infection chain Compromised site --> henreques[.]lol/file.js (ClickFucker) --> henreques[.]lol/api/v1/session (token) --> henreques[.]lol/api/v1/verify (gateway) --> henreques[.]lol/api/v1/status (clipboard)

Detected #KongTuke infection chain Compromised site --> henreques[.]lol/file.js (ClickFucker) --> henreques[.]lol/api/v1/session (token) --> henreques[.]lol/api/v1/verify (gateway) --> henreques[.]lol/api/v1/status (clipboard) --> cloudpass7138[.]lol/update/package (tar) a83f4d0056f8008633e1531c5f85abe683920445a085db486222f673dc90544a package

Detected #KongTuke infection chain Compromised site --> carreiro[.]lol/file.js (ClickFucker) --> carreiro[.]lol/api/v1/session (token) --> carreiro[.]lol/api/v1/verify (gateway) --> carreiro[.]lol/api/v1/status (clipboard)

Detected #KongTuke infection chain Compromised site --> fraitas[.]lol/file.js (ClickFucker) --> fraitas[.]lol/api/v1/session (token) --> fraitas[.]lol/api/v1/verify (gateway) --> fraitas[.]lol/api/v1/status (clipboard) --> tommy-q[.]lol/o (powershell) ab0cb56912b87e6baf56ccced556f726d988c432561e94d671a15e891bb7d9df o

Detected #KongTuke infection chain Compromised site --> azevedo[.]lol/file.js (ClickFucker) --> azevedo[.]lol/api/v1/session (token) --> azevedo[.]lol/api/v1/verify (gateway) --> azevedo[.]lol/api/v1/status (clipboard) --> microcrypt1987[.]com/update/package (tar) 2131cf9393df3e9b210aca80bbe332ee705f57acf0db48d6033e75432c6232db package

Detected #KongTuke infection chain Compromised site --> robests[.]lol/file.js (ClickFucker) --> robests[.]lol/api/v1/session (token) --> robests[.]lol/api/v1/verify (gateway) --> robests[.]lol/api/v1/status (clipboard) --> tommy-z[.]lol/o (powershell) a20acbf2ec91266634db4658dca4b04770f27c28e92799f55ee9820b25c3550d o