Malware
KongTuke
aka TAG-124 · js.LandUpdate808
Kongtuke is a sophisticated TDS system that was initially discovered around May 2024.
KongTuke, also known as TAG-124, js.LandUpdate808, is a JavaScript malware family.
Background
Kongtuke is an advanced TDS first identified around May 2024. Leveraging compromised CMS websites, it funnels visitors through a multi-stage infection chain that ultimately compromises their device. It began with fake Update lures and shifted to FakeCaptcha lures in early 2025. Kongtuke is probably an initial access service, selling infections to both ransomware affiliates and other IA vendors such as SocGholish.
Source: Malpedia (Fraunhofer FKIE).