IOC Alert: Kongtuke JavaScript Payload Masquerading as Restaurant Website

📖 Overview

A JavaScript payload associated with the Kongtuke malware family has been discovered hosted on a compromised domain masquerading as a restaurant website. The malicious script is delivered via js.php, a common filename used in JavaScript injection attacks, and is believed to be part of a broader payload delivery campaign. Confidence is assessed at 100%.

📌 Key Details

🔎 URLScan Result

• Verdict Score: 0
• Page Title: Garbanzo Mediterranean Restaurant Near Me | Pita, Salad, Gyro, Bowls
• Screenshot: View Screenshot
• Result: Full Scan Report

📡 Related Intelligence

• VirusTotal Report: VirusTotal URL Report

🛡️ Defensive Guidance

• Block access to prixmatech[.]com and any requests to /js.php endpoints across DNS, proxy, and web gateways.
• Inspect web server logs for any evidence of injected JavaScript payloads or external script loading from suspicious domains.
• Monitor for execution of scripts or network calls tied to Kongtuke signatures.
• Deploy content security policies (CSP) to limit JavaScript execution from untrusted origins.

⚠️ This IOC highlights the use of legitimate-looking commercial websites as decoy fronts for distributing JavaScript-based malware like Kongtuke, which often targets users through embedded scripts or drive-by infection techniques.