2025-08-20 (Wed): still using style instructions on its fake CAPTCHA pages.
I never got any further than the HTTP POST request that sends information about the infected system host.
Details at: https://github.com/malware-traffic/indicators/blob/main/2025-08-20-IOCs-for-Kongtuke-activity.txt
August 20, 2025 at 5:16:07 PM