KongTuke Abandoning “ClickFix” to Launch Direct Microsoft Teams Attacks

ReliaQuest researchers attribute a fast, active initial access campaign to the financially motivated broker ‘KongTuke’, which has shifted from web-based lures to external Microsoft Teams chats to socially engineer victims into pasting a PowerShell command. The command drops a custom Python loader that installs ModeloRAT—a resilient RAT with three independent C2 paths and multiple persistence triggers—using a VBScript wrapper and a startup shortcut to achieve rapid, hard-to-contain footholds in enterprise environments.