Detected #KongTuke infection chain Compromised site --> phiplips[.]click/l1hdpx7b.js (ClickFucker) --> phiplips[.]click/api/v1/session (token) --> phiplips[.]click/api/v1/verify (gateway) --> phiplips[.]click/api/v1/status (clipboard) --> tommy-eg[.]top/f (powershell) 372fa1524bcf4bb658b87d830071be38826beafb3311cd73c3d0314433233a5c f