Research
Canada Dry's Canadian site and four sister brand sites, Mott's Clamato, Nestea, Core Hydration and Bai, carry KongTuke. Two of them loaded it as early as 17 July 2026. On the afternoon of 10 November 2026 all five still carried it, and three were showing visitors a fake Cloudflare check.
An iPhone exploit server we captured on 4 and 5 November 2026 picks Coruna or DarkSword by iOS version. It keeps a third route, C10, for iOS 26. A config file has C10 switched off, nothing is deployed at its path, and its only iOS 26 plugin is filed under a Google Chrome CVE.
From 28 July to 3 November 2026 a fake Cloudflare check we call ClockTail ran on 245 hosts. Its command was never filled in, so it copies a saved Google page to the clipboard instead of a command. On 3 November 103 hosts still served it.
On 29 October 2026 the DebugBear monitoring script Polymarket loaded was replaced with a wallet drainer. In 52 minutes its recipient wallet took in 28,636,284.45 POL and positions from 33 accounts, and it had forwarded everything by 18:38 UTC.