Search Poisoning Campaign Spreads Kong RAT via Fake DeepSeek Installers
Attackers are using search poisoning to distribute the Kong RAT trojan by masquerading as legitimate DeepSeek local deployment tools.
Malware analyst Vlad Pasca published an analysis detailing a search-poisoning campaign targeting users searching for DeepSeek software by serving lookalike sites that distribute the Kong RAT remote access trojan with keylogging capabilities. Domains like deepseekcn[.]cyou reach first-page search results, alongside other distribution domains including deepseekk[.]icu, deepsecek[.]com, deepseekem[.]com, and callmysoft[.]com/deepseek, which hosted a code-signed fake DeepSeek Local Deployment Tool.
Victims downloading the 100MB+ archive "DeepSeekV20.66-Setup.zip" receive an MSI installer that drops a signed "DeepSeekV20.66.exe" and "Setupapp.exe", which has the SHA256 hash 566449fe632fc7687d7a7f4b436ba01c1e38756bcab77567798452d000254c5c. The executable uses VirtualAlloc and CreateThread APIs to run shellcode downloaded as "mao.mp4" from an Alibaba Cloud Hong Kong storage domain.
The embedded DLL checks for a running Telegram.exe process to switch its language to "classic-zh-cn", creates a staging directory under AppData\Local\Programs named from the C drive serial number, and downloads "Defcyglaunch.exe.exe", "cygwin1.dll", and "Uninstall.xml" from a command-and-control server. A scheduled task named "SimpleActivityScheduleTimer_" initiates side-loading through the legitimate Cyglaunch program.
The malware checks for admin rights, modifies the Userinit value under the Winlogon registry key for persistence, and executes Uninstall.xml. The payload creates a mutex, uses PowerSetRequest to keep the display on, checks Software\Kong\Client\ClientVersion for a "LastHash" value, and communicates with m.tysdt123[.]com on port 5947 using a custom protocol starting with the string "MPK1".
Kong RAT receives a 64-bit DLL from the C2 server, supports file download, command execution, and system reboot commands, and records keystrokes, clipboard contents, and foreground window titles into daily .txt files in C:\ProgramData\Kong\Keylogger. The analysis points to a possible Chinese threat actor due to a PDB path referencing the 52pojie forum, continuing an April 2026 campaign that targeted users searching for FinalShell, Xshell, and Clash proxy.