hk

Injected KongTuke script in page from compromised website.

Fake CAPTCHA page from KongTuke domain, scrroeder[.]com.

KongTuke's "ClickFix" command injected into the viewer's clipboard.

Traffic from the activity filtered in Wireshark. I did not get the malware from this.

2026-01-05 (Monday): #KongTuke domain scrroeder[.]com generated #ClickFix script for 144.31.221[.]71, but I didn't get a malware infection when I tried it today.

God I hate the fact that Threat + Hunting is being called "Thrunting." And we now have Threat + Hunters who are "Thrunters." This is all I can see when I see these terms...

Page to download the initial file.

HTTPS URLs seen from the infection.

Traffic from the infection filtered in Wireshark.

Example of post-infection data exfiltration traffic.

2025-10-16 (Thursday): Unidentified #stealer/#Loader found when searching for URLs that follow patterns previously seen for Koi Loader/Koi Stealer.

Details at github.com/malware-traf...

Screenshot of the email.

Screenshot of webpage for the malware download.

Downloaded malware EXE showing digital signature and metadata.

Scheduled task to keep the infection persistent.

2025-09-25 (Thursday): Received an email distributing a malicious installer for an #RMM tool. Details at github.com/malware-traf...

Screenshot of the email.

Screenshot of webpage for the malware download.

Downloaded installer EXE showing digital signature and metadata.

Scheduled task to keep the infection persistent.

2025-09-29 (Monday): Follow-up to my post last week. I've been seeing one or two of these emails almost every day. Details on the latest example at github.com/malware-traf...

Screenshot of icon for the malicious app on a cell phone.

Screenshot of the login screen for the malicious app on a cell phone.

It's asking me to place a credit card on the phone.

Traffic from an infection filtered in Wireshark.

2025-10-02 (Thursday): #pcap and some images from an Android malware infection at www.malware-traffic-analysis.net/2025/10/02/i...

Screen shot of the blog post.

2025-10-06 (Monday): A collection of 200+ phishing emails in Japanese that were sent to my blog email addresses. Available at www.malware-traffic-analysis.net/2025/10/06/i...

Thank you!

Screenshot of the page from my website with the post for this information.

Example of path to download the initial 7-zip archive for the malware.

Page with the download for the initial 7-zip archive.

Traffic from the possible Rhadamanthys malware, filtered in Wireshark.

2025-10-01 (Wed) I've posted #malware samples and a #pcap of the post-infection traffic from an infection by possible #Rhadamanthys malware at www.malware-traffic-analysis.net/2025/10/01/i...

This is from a file disguised as a cracked version of software, and I usually see #LummaStealer from this.

Looking forward to the exercise file. 🙂

Dr. Brian Fehrman give us his reason why we want to defeat AI-Based Malware Detection.

Join us for a free one-hour session with AI-security researcher & BHIS pentester Dr. Brian Fehrman on defeating AI malware detection with AI.

Thu, Sep 11 1:00 PM ET
Register: events.zoom.us/ev/AuO1quTvv...

THURSDAY - BHIS Webcast

What if you could use AI to defeat AI-based malware detection?

Join us for a free one-hour session with AI-security researcher and BHIS pentester Brian Fehrman on defeating AI malware detection with AI.

Thu, Sep 11 1:00 PM EDT

Register: events.zoom.us/ev/AuO1quTvv...

Hey folks!

WEDS- Antisyphon Training Anticast

Join Nick Ascoli & Eric Clay from Flare for a free one-hour training session, "Unraveling Infostealer Threat Networks,".

Wed, Sep 10 12:00 PM EDT

Register: events.zoom.us/ev/AtRoO7tR8...

Kongtuke style injected script in page from compromised website

Fake CAPTCHA page that performs clipboard hijacking (pastejacking) showing the ClickFix style instructions and malicious script a victim would paste into a Run window or command line terminal.

Location of the downloaded zip archive for Lumma Stealer, and the content of that zip archive in the user's AppData\Roaming directory.

Traffic from an infection filtered in Wireshark.

2025-09-03 (Wednesday): #Kongtuke fake CAPTCHA page leads to #ClickFix style script for #LummaStealer

A #pcap of the infection traffic, the associated malware, and IOCs are at www.malware-traffic-analysis.net/2025/09/03/i...

Blue teamers — sometimes we can lose sight of Active Directory. I mean, it just works in the background, right? Active Directory is crucial to Windows networks & a perfect target for bad actors. Dive into this article to learn common active directory pitfalls 7 how to avoid getting your day ruined.

Anti-Cast: Finding and Fixing AD CS Issues with Locksmith with Jake Hildreth - Antisyphon Training Join us for a free one-hour infosec training session from Trimarc’s Jake Hildreth on Finding and Fixing AD CS Issues with Locksmith.

Howdy folks. I'm sending this skeet to let you know about the free @antisyphontraining.bsky.social Anti-cast tomorrow on Finding and Fixing AD CS Issues with Locksmith w/ Jake Hildreth (@dotdot.horse).

Jake's my coworker & friend. Sign up!

www.antisyphontraining.com/event/anti-c...

Do you want to level up your cloud penetration testing skills? Then be sure to register for "Breaching the Cloud" with Beau Bullock for pre-con training at Wild West Hackin' Fest @ Mile High 2025! Check out details and register here: wildwesthackinfest.com/wild-west-ha...

Black Friday 2024 - Antisyphon Training Starting today November 26th through December 1st, 2024, when you sign up for our Black Friday deal you will get access forty On-Demand classes on the

For Black Friday, AntiSyphon Training is offering our full OnDemand catalog (40+) classes with labs and everything for $1,500 per year.

That is like 90+% off.

www.antisyphontraining.com/black-friday...

For one of my side hustles, I opened a Local Game Store a few months ago. We've been grinding away getting ready for Black Friday and for the first time I feel like the store is full. This has been such an awesome building and learning experience. We are as ready as we can be!

You can read the entire Threat Hunting issue of PROMPT# for FREE:
www.promptzine.com/threat-hunti...

Do you want AI to take your job? NO! Give yourself a holiday present and attend the "AI for Cyber Security Professionals" two day course at the @antisyphontraining.bsky.social Secure Code Summit on Dec5th and 6th 2024. www.antisyphontraining.com/course/ai-fo...
I promise this will change your life!

AC-Hunte is a network threat hunting tool that analyzes network traffic to detect which internal systems have been compromised.

Get AC-Hunter CE for FREE - www.activecountermeasures.com/ac-hunter-co...

How to use AC-Hunter:
youtu.be/26saE26aQ4o
youtu.be/mTIDoZ7I-Co?...
youtube.com/playlist?lis...