KongTuke activity, (Tue, Nov 18th)

This diary documents KongTuke (aka LandUpdate808/TAG-124) using fake CAPTCHA/ClickFix lures on compromised legitimate sites to socially engineer users into pasting a PowerShell command that downloads a ZIP with a malicious Python environment and script. The infection persists via a scheduled task, communicates with 64.111.92.212:6655 and telegra.ph, and leaves indicators in AppData\Roaming and scheduled tasks.