KongTuke Continues ClickFix Attacks Through Compromised WordPress Sites to Deliver ModeloRAT

Mar 10, 2026 · Original article ↗

Summary

Trend Micro MDR analysis links KongTuke activity to compromised WordPress sites and fake CAPTCHA prompts delivering modeloRAT. The article details its execution, reconnaissance and persistence; user interaction with the lure in the investigated case was not conclusively

Key points

Trend Micro MDR investigators found evidence consistent with a ClickFix-style fake CAPTCHA lure on a compromised WordPress site; they could not conclusively confirm the user interacted with it.
The site’s injected JavaScript could collect browser and system information and dynamically load content from a remote server.
The reported execution chain abused PowerShell and a renamed Windows finger.exe to retrieve commands, then used obfuscated scripts and a portable Python environment to run modeloRAT.
The malware checked for analysis tools, identified domain membership and installed antivirus products, and collected host and network information.
Investigators observed likely command-and-control communications and persistence through a Run registry entry and a scheduled task.
The article says VirusTotal submissions showed multiple WordPress sites with similar injections, suggesting the delivery method remained active; it also notes KongTuke’s separate CrashFix technique.
Recommended defenses include updating WordPress and its plugins, monitoring suspicious PowerShell and process activity, and warning users not to run commands prompted by CAPTCHA pages.

Article Details

Attack Vectors: KongTuke injected JavaScript into compromised WordPress sites; the scripts could retrieve and inject remote content, leading to a fake CAPTCHA prompt that instructed users to run a PowerShell command.
The reported CrashFix variant tricks users into installing a malicious Chrome extension that displays a fake security warning and prompts them to execute a PowerShell command. The article says this method was not observed in the MDR investigation described.
The command copied the legitimate Windows finger.exe utility to a temporary file and used it to retrieve data from an external IP, piping the response into the command interpreter.
On domain-joined systems, the malware downloaded a portable Python environment and additional scripts, then used Python to run modeloRAT.
Defensive Notes: Patch and maintain WordPress core files, themes, and plugins; disable unused plugins and enforce strong administrative controls.
Configure endpoint detection and monitoring to alert on suspicious command lines, encoded PowerShell, unusual parent-child process relationships, and anomalous outbound connections.
Train users not to copy and run commands in response to website prompts, including fake CAPTCHA or security-warning instructions.

Indicators of compromise

Type	Indicator	Context
IPV4	`158[.]247[.]252[.]178`	External IP contacted by modeloRAT; the article assesses the outbound connection as likely command-and-control communication.
IPV4	`162[.]33[.]178[.]171`	IP identified alongside the malicious foodgefy JavaScript URL as its external infrastructure.
IPV4	`170[.]168[.]103[.]208`	External IP contacted by modeloRAT; the article assesses the outbound connection as likely command-and-control communication.
IPV4	`45[.]61[.]138[.]224`	External endpoint contacted by the renamed finger.exe utility; the response was piped to the command interpreter, enabling remote command execution.
URL	`hxxps[:]//ainttby[.]com/6f54.js`	Injected external JavaScript reference found on a compromised website and linked by an earlier report to KongTuke activity.
URL	`hxxps[:]//ctpsih[.]com/2d5h.js`	Injected external JavaScript reference found on a compromised website and linked by an earlier report to KongTuke activity.
URL	`hxxps[:]//foodgefy[.]com/6o0jk.js`	Malicious injected JavaScript URL on a compromised website; the script could receive and inject remote content.
URL	`hxxps[:]//www[.]dropbox[.]com/scl/fi/np4h0kexqq5r9vlpzwg4d/rp?rlkey=fwg1koexylntccobyxaliju7w&st=3wxzp44k&dl=1`	Specific Dropbox-hosted URL used to download the additional modeloRAT payload script extentions.py.