KongTuke injected malicious scripts into five beverage sites including Canada Dry
Ohey found malicious JavaScript on five beverage sites including Canada Dry’s Canadian site. It collects browser-readable cookies and token-like storage values, then shows some visitors a fake Cloudflare check. Windows users who run the pasted command can download and execute malware.
- Disclosed
- Nov 10, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Visitors to five beverage sites. Windows users who ran the fake verification command also risk endpoint compromise.
- WordPress · ClickFix · malware · JavaScript
- In the wild
- Yes
- Ohey captured malicious code on five sites. The number of infected endpoints is unknown.
What happened
Ohey captured KongTuke code on canadadry.ca, mottsclamato.ca, drinknestea.ca, hydratewithcore.com and drinkbai.com. Historical public scans put the earliest script Ohey found on Mott’s Clamato and Nestea on July 17. The November 10 report publicly disclosed this group of affected sites. All five share a parent company and use different servers and WordPress themes. The initial access path and number of affected users remain unclear.
Three sites serve the loader through /asset-cache/fjs on their own domain. Core Hydration and Bai reference changing external hosts. Before deciding whether to show fake verification, the loader collects JavaScript-readable cookies and token-like values in local or session storage. For Windows visitors who get the lure, it puts a command on the clipboard and prompts them to run it through the Run dialog. Ohey captured a chain using an FTP greeting to download and start vclreg.exe and vclx370.bpl.
The researchers confirmed malicious code on live websites and observed active delivery. The number of infected endpoints and any payment-data theft remain unknown. The compromise of public sites delivering malware warrants L4.
Crime-scene timeline
Jul 17, 2026
Public scans capture earlier loaders
Ohey identifies scripts in historical scans of the Mott’s Clamato and Nestea sites.
Nov 10, 2026
Ohey publishes captures from the beverage sites
The researchers confirm malicious code on four sites and add Bai in a same-day update.
Nov 10, 17:30 UTC
Ohey adds a fifth site and details the download stage
The researchers confirm the Bai script and file downloads triggered by an FTP greeting.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Ohey KongTuke investigationPrimaryDocuments five brand sites, script behavior and delivery indicators from captures and static analysis.