Canada Dry's Canadian site, canadadry.ca, and four sites from the same parent company are serving KongTuke ClickFix malware to their visitors. Kirk of ohey.ca published the research on November 10th, 2026, and Tuxxin contributed to it.
The five sites are canadadry.ca, mottsclamato.ca, drinknestea.ca, hydratewithcore.com and drinkbai.com. Two of them first loaded the malware on July 17th, 2026, and all five still carried it on the afternoon of November 10th.
Visitors see a fake Cloudflare "verify you are human" check that tells them to press Win+R, paste a command and press Enter. A visitor who follows the steps downloads and runs the operators' malware.
Tuxxin's part
Tuxxin found the fifth site, drinkbai.com, and traced the next stage of the attack: the server response that downloads the malware onto a visitor's computer. Ohey's scanner confirmed both findings.
Kirk's article covers how the sites were compromised, the timeline for all five and the full indicator list: KongTuke ClickFix comes for a Canadian treasure: Canada Dry.