Ohey research https://ohey.ca/research/ Web threat research from Ohey: incident write-ups with timelines, code analysis and indicators. en-ca KongTuke ClickFix comes for a Canadian treasure: Canada Dry https://ohey.ca/research/kongtuke-canada-dry-clickfix/ https://ohey.ca/research/kongtuke-canada-dry-clickfix/ Tue, 10 Nov 2026 00:00:00 GMT canadadry.ca and four sister brand sites serve KongTuke's ClickFix loader to visitors. Two had it in July 2026, and all five still did on 10 November. DarkSword router's iOS 26 route, C10, is switched off https://ohey.ca/research/darksword-router-ios-26-c10/ https://ohey.ca/research/darksword-router-ios-26-c10/ Thu, 05 Nov 2026 00:00:00 GMT A DarkSword and Coruna router on 154.222.16[.]220 sends iOS 26 to a chain it calls C10. Its config has C10 off, and its iOS 26 plugin carries a Chrome CVE. ClockTail: a ClickFix kit that never filled in its command https://ohey.ca/research/clocktail-clickfix-unfilled-command/ https://ohey.ca/research/clocktail-clickfix-unfilled-command/ Tue, 03 Nov 2026 00:00:00 GMT ClockTail ran on 245 hosts with its command address left as a template placeholder, so its fake Cloudflare check copies a saved Google page to the clipboard. Polymarket wallet drainer served from DebugBear's script CDN https://ohey.ca/research/polymarket-debugbear-wallet-drainer/ https://ohey.ca/research/polymarket-debugbear-wallet-drainer/ Thu, 29 Oct 2026 00:00:00 GMT A DebugBear monitoring script on Polymarket became a wallet drainer on 29 October 2026 and sent 28.6M POL and 33 accounts' positions to a single wallet.