canadadry.ca · Breach

[Single source] Four Canadian beverage sites deliver KongTuke ClickFix

Nov 10, 2026 · 1 min read

A planted WordPress plugin on the four sites delivers KongTuke and sends cookies and token-like values to the operator. Selected visitors receive a fake Cloudflare verification page containing a ClickFix command. No remediation was reported; visitors should not run the command offered by the fake page.

By HIFY Radar newsroom Updated 11/10/2026 02:42 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

A November 10 report says four Canadian beverage websites were serving the KongTuke loader. According to the researcher, selected visitors saw a fake Cloudflare check that copied a ClickFix command, while data collection occurred before visitor filtering. The supplied evidence does not independently confirm the compromise or any remediation.

What happened

Alleged

The researcher attributes the activity to a planted WordPress plugin. Three sites reportedly served the loader from their own domains at /asset-cache/fjs, even though the plugin fetched it from infrastructure controlled by the alleged operator. This arrangement meant a visitor's browser appeared to contact only the beverage brand's site.

Why it matters

Alleged

The reported chain combines silent data collection with social engineering. The loader allegedly sent script-readable cookies and storage values whose names resembled authentication or session tokens before deciding whether to show the lure. Accepted visitors were then prompted to run a command presented as part of a security check.

What to do

Inferred

Visitors should not run commands copied by an unexpected Cloudflare-style verification page. Anyone who followed such instructions on one of the named sites should disconnect the affected device if practical, seek security support, scan for malware, review account sessions and rotate potentially exposed credentials from a clean device.

Confirmed and still uncertain

Observed

The evidence batch contains one detailed researcher post with domains, dates, delivery paths and infrastructure changes. It contains no independent confirmation from the site owner, Cloudflare, a hosting provider or another security team, and it does not establish how the plugin was planted, how many visitors were affected, whether stolen values were usable or whether the sites have been remediated.

What people are saying

Alleged

Researcher ectkirk says canadadry.ca, mottsclamato.ca, drinknestea.ca and hydratewithcore.com were carrying KongTuke on November 10, 2026. The researcher also says the FTP host embedded in the ClickFix chain changed from report-ftp.wiki to yelahaye.surf during that afternoon.

Evolution

Alleged

The reported history predates the November discovery. Public scans allegedly showed the Mott's Clamato and Nestea sites loading KongTuke from monteiro.click on July 17. Canada Dry was reportedly clean on July 16, then first served /asset-cache/fjs on October 29. Core is said to have rotated through four external hosts beginning in September.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements. Observed communities: r/pwnhub.

Technical detail

Alleged

Three sites allegedly used a first-party-looking /asset-cache/fjs endpoint, while hydratewithcore.com loaded from battaglia.lol through a tag associated by the researcher with a plugin named Web Media Optimizer. The fake verification page reportedly copied a command that piped FTP output into Windows Command Prompt and attempted to run in a minimized window.

Sources and evidence

Observed

All details in this article come from a single Reddit submission by ectkirk that summarizes a linked research write-up. No screenshots, scan records, site-owner statements or additional reports were included directly in the supplied evidence batch, so the technical findings should be treated as the researcher's claims rather than independently verified facts.