Beware: Fake CAPTCHA Scams Hijacking Clipboards with Malicious Commands!
KongTuke, also known as LandUpdate808, uses fake CAPTCHA pages to trick users with a ClickFix-style lure. This crafty tactic hijacks the clipboard, leading victims into running a malicious PowerShell script. Remember, folks, not all CAPTCHAs are created equal—some just want you to solve the riddle of infection!
Hot Take:
Who knew the rise of CAPTCHA could lead to the ultimate plot twist: a sinister hacker drama where clicking “I am not a robot” actually makes you the unwitting star of a botnet movie? KongTuke has turned CAPTCHA into a clickbait nightmare, leaving internet users to wonder: Is that bot-proof page actually a test of our gullibility?
Key Points:
- KongTuke (also known as LandUpdate808 or TAG-124) is a sophisticated TDS system using fake CAPTCHA pages.
- The campaign hijacks users’ clipboards to inject malicious PowerShell commands.
- Infected systems download a zip containing a Python script and environment, maintaining persistence via a scheduled task.
- Infection traffic generates HTTPS requests to telegra[.]ph, a non-malicious domain.
- Despite detailed infection traffic analysis, the exact purpose of the malicious script remains a mystery.
Already a member? Log in here