Detected #KongTuke infection chain

Compromised site
-->
aawbi[.]com/5232f.js
-->
aawbi[.]com/js.php (ClickFix)
-->
zeftasarim[.]com/lefter (Powershell)

c75b99b5a5d90f74aabb4596cf515f6f448b224a04e7e30d6f0d10b8348d8f6b lefter

Detected #KongTuke infection chain

Compromised site
-->
aawbi[.]com/5232f.js
-->
aawbi[.]com/js.php (ClickFix)

Detected #KongTuke infection chain

Compromised site
-->
aawbi[.]com/5232f.js
-->
aawbi[.]com/js.php (ClickFix)
-->
artsselection[.]com/bookmarks (Powershell)

3b12fea31ace4c4d105c0f9f3e7c85d29bd18b5bef5fbde38043ebdff483abe0 bookmarks

Detected #KongTuke infection chain

Compromised site
-->
voginc[.]com/58hgs.js
-->
voginc[.]com/js.php (ClickFix)
-->
afshapiro[.]com/parter (Powershell)

69a6294bb0c583d111c5b300d3a81cadb996cd64693b4c658444cb257f67ce77 parter

Detected #KongTuke infection chain

Compromised site
-->
voginc[.]com/58hgs.js
-->
voginc[.]com/js.php (ClickFix)
-->
afshapiro[.]com/search (Powershell)

e16b6e52ded7aac2817f628727faff5adbcda5c8c4341c5768e9a0353d578aa0 search

Detected #KongTuke infection chain

Compromised site
-->
voginc[.]com/58hgs.js
-->
voginc[.]com/js.php (ClickFix)

Detected #KongTuke infection chain

Compromised site
-->
flatheadcat[.]com/7s99.js
-->
FlatheadCat[.]com/js.php (ClickFix)

Detected #KongTuke infection chain

Compromised site
-->
flatheadcat[.]com/7s99.js
-->
FlatheadCat[.]com/js.php (ClickFix)
-->
obmlink[.]com/right (Powershell)

8bce465c5cfd4c0bffef68fd4e89c25a1dc86b8793e2ea75b4264f045fdf265a right

Detected #KongTuke infection chain

Compromised site
-->
flatheadcat[.]com/7s99.js
-->
FlatheadCat[.]com/js.php (ClickFix)
-->
obmlink[.]com/clients (Powershell)

43073ccc7fa55ee10ba413da4ca6f714f66f83055c952cfee0c51410a051ec4f clients

Detected #KongTuke infection chain

Compromised site
-->
ussbtv[.]com/4a9g.js
-->
ussbtv[.]com/js.php (ClickFix)