Unit 42 Intel took to X on April 4, 2025, to alert the public, stating: “Injected #KongTuke script in pages from legitimate but compromised websites leads to fake #CAPTCHA style pages and #ClipboardHijacking (#pastejacking). These pages ask users to paste malicious script into a Run window.” The post, accessible at included a link to further details and a visual of the fake CAPTCHA page, emphasizing the urgency of awareness. Detailed in a report by Bradley Duncan of Palo Alto Networks’ Unit 42 team, this attack leverages malicious scripts and fake CAPTCHA pages to hijack victims’ clipboards and potentially install unidentified malware. 2025-04-04 (Friday): Injected #KongTuke script in pages from legitimate but compromised websites leads to fake #CAPTCHA style pages and #ClipboardHijacking (#pastejacking). Instead of verifying identity, the page employs a technique known as “clipboard hijacking” or “pastejacking.” It covertly injects a malicious PowerShell script into the victim’s clipboard, accompanied by instructions urging the user to paste and execute it via a Windows Run window. A sophisticated new cyberattack chain dubbed “KongTuke” has been uncovered by cybersecurity researchers, targeting unsuspecting internet users through compromised legitimate websites. The KongTuke attack begins with a malicious script injected into legitimate but vulnerable websites.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 05 Apr 2025 13:35:26 +0000