#ParsedReport #CompletenessMedium
17-09-2026

Brevo delivered ClickFix through its own infrastructure

https://adamnet.works/blog/brevo-delivers-kongtuke-clickfix-to-customer-sites/

Report completeness: Medium

Actors/Campaigns:
Kongtuke

Threats:
Clickfix_technique
Kongtuke
Junk_code_technique
Copyfail_vuln
Mintsloader

Victims:
Brevo, Customer websites, Ecommerce, Wordpress sites

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027, T1036, T1059.001, T1059.003, T1082, T1105, T1140, T1195.002, T1204.004, T1505, have more...

IOCs:
Url: 17
Domain: 109
Hash: 13
File: 9
Path: 2
IP: 3

Soft:
Brevo, Chrome, WordPress, Curl, Firefox

Algorithms:
zip, base64

Functions:
_guik

Languages:
php, powershell, javascript