{"id":60293,"date":"2026-03-10T00:00:00","date_gmt":"2026-03-10T00:00:00","guid":{"rendered":"urn:uuid:7b84d5db-10d8-28c5-2fa4-ffd34b0d875c"},"modified":"2026-03-10T00:00:00","modified_gmt":"2026-03-10T00:00:00","slug":"through-the-lens-of-mdr-analysis-of-kongtukes-clickfix-abuse-of-compromised-wordpress-sites","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/through-the-lens-of-mdr-analysis-of-kongtukes-clickfix-abuse-of-compromised-wordpress-sites\/","title":{"rendered":"Through the Lens of MDR: Analysis of KongTuke\u2019s ClickFix Abuse of Compromised WordPress Sites"},"content":{"rendered":"

<\/p>\n

<\/div>\n

While the execution of the bytecode was not successful in our tests, we saw that it contains strings and a reference to another file named AppData\\Local\\Microsoft\\Windows\\SoftwareProtectionPlatform\\run.pyw<\/b>, which was also dropped in the same infected host.<\/p>\n

The following is a list of extracted names\/functions:<\/p>\n

Names: (‘psutil’, ‘os’, ‘subprocess’, ‘sys’, ‘time’, ‘getcwd’, ‘var_de19fc0291090dcb’, ‘path’, ‘normcase’, ‘var_2e81fe4a2321309f’, ‘_decrypt_str’, ‘var_358b2857d44181b1’, ‘startswith’, ‘exit’, ‘main’, ‘__name__’)<\/span><\/p>\n

Analyzing the file run.pyw shows that it has similar structure and flow as udp.pyw, but with a larger data this time around. Applying the same deobfuscation method, we saw run.pyw loads the Python bytecode via the marshal module. The following is a list of extracted names\/functions:<\/p>\n

Names: (‘socket’, ‘sys’, ‘subprocess’, ‘os’, ‘html’, ‘re’, ‘time’, ‘bs4’, ‘BeautifulSoup’, ‘threading’, ‘psutil’, ‘requests’, ‘Crypto.Util.Padding’, ‘Crypto’, ‘base64’, ‘getcwd’, ‘var_de19fc0291090dcb’, ‘path’, ‘normcase’, ‘var_2e81fe4a2321309f’, ‘_decrypt_str’, ‘var_358b2857d44181b1’, ‘startswith’, ‘exit’, ‘var_c68c19a0ea74d15a’, ‘var_2b6b8037e2428633’, ‘var_d7ee27df16fe75f8’, ‘var_0d6f193b19a44f4a’, ‘var_6560076c59ac87ac’, ‘check’, ‘Thread’, ‘var_fd8ce270b6003277’, ‘start’, ‘get’, ‘var_cea36d54b621a48f’, ‘text’, ‘var_d09efe76ced85d6d’, ‘find’, ‘var_0e23b5f319056839’, ‘var_7c5f6bb71383d3f3’, ‘split’, ‘var_6d5d29b8058bdf65’, ‘var_687b9b2c70a5c665’, ‘var_faf655de6214f02a’, ‘var_86c69be4c78f2621’, ‘b64decode’, ‘var_1363a4c4e644abdf’, ‘bytes’, ‘enumerate’, ‘len’, ‘var_40eab56476d5b9f6’, ‘decode’, ‘var_ae751dbc35895e07’, ‘var_794ede7b4b034ebe’, ‘xor_encrypt_decrypt’, ‘get_codepage’, ‘run_command’, ‘get_domain’, ‘connect_to_server’, ‘authenticate’, ‘main’, ‘__name__’)<\/span><\/p>\n

The bytecode includes string entries related to functions for internet access, system control, and self-concealment, indicating it is a persistent backdoor designed for remote access and command execution.<\/p>\n

The Kongtuke threat group is not replacing their old tradecraft but expanding it. While security reporting from Huntress highlighted the emergence of the new CrashFix technique, our MDR findings confirm that the group still uses compromised WordPress websites and fake CAPTCHA lures as infection vector.<\/p>\n

Both delivery paths \u2014 CrashFix browser-extension abuse and ClickFix\/fake CAPTCHA chains \u2014 ultimately converge on the same objective: the deployment of the Python-based modeloRAT. The consistency of the payload across different initial access methods demonstrates a mature, modular operation. Kongtuke is diversifying entry techniques while maintaining a stable and reliable post-exploitation framework.<\/p>\n

Telemetry from VirusTotal further supports that this activity could still be ongoing. Multiple compromised websites remain injected, increasing the likelihood of continued exposure. This also demonstrates the group\u2019s focus on scale, persistence, and adaptability rather than single-wave campaigns.<\/p>\n

Organizations can mitigate this threat by adopting a layered defensive approach:<\/p>\n