New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns

**Mistic** is a stealthy in-memory backdoor (tracked as MLTBackdoor) used since April 2026 by initial access broker KongTuke to provide long-term, low-visibility access to multiple sectors; it is distributed via ClickFix-style chains (malicious Chrome extension, DNS staging, Teams lures), employs DLL sideloading with trusted Microsoft tooling, can execute code and load BOFs in memory, and has been linked to ModeloRAT and subsequent ransomware activity (e.g., Qilin).