Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

KongTuke / CrashFix campaign uses a malicious Chrome extension and ClickFix-style lures

Campaign
First reported
Last updated
Happening score
H score 41
1 unique sources, 1 articles

Summary

Hide ▲

An ongoing KongTuke / CrashFix campaign is using a malicious Google Chrome extension and ClickFix-like lures to push victims into running commands that deploy ModeloRAT, raising the risk of compromise and follow-on access. The operation disguises the extension as an ad blocker and forces a browser crash to steer users toward a fake fix. It also tracks victims and stages payloads from attacker infrastructure before handing some systems off for deeper access. The targeting suggests a broad corporate-environment risk rather than a one-off lure.

Related Happenings

ClickFix payload delivery analysis exposes API-driven generation and Downloads-folder AMSI evasion

Technical Analysis
H score74 First: 01.07.2026 08:32 Last: 01.07.2026 08:32 Sources 1

About this happening: Analysis of ClickFix payload delivery shows operators moving to API-driven servers and a Downloads-folder orchestrator, increasing stealth across live campaigns. The b...

Open Happening

MacOS ClickFix Terminal-delivered DMG campaign

Campaign
H score37 First: 23.06.2026 21:30 Last: 23.06.2026 21:30 Sources 1

About this happening: A macOS ClickFix campaign is using fake CAPTCHA pages and Terminal commands to quietly download and launch malicious DMG files, putting Mac devices at risk of...

Open Happening

ClickFix multi-loader delivery campaign targeting Windows and macOS users

Campaign
H score34 First: 16.06.2026 20:41 Last: 16.06.2026 20:41 Sources 1

About this happening: The ClickFix malware-delivery campaign is spreading BabaDeda Loader, Lorem Ipsum Loader, and Potemkin, widening risk for Windows and macOS users across several...

Open Happening

ACSC ClickFix mitigation guidance for Vidar Stealer

Advisory/Mitigation
H score34 First: 07.05.2026 21:00 Last: 07.05.2026 21:00 Sources 1

About this happening: The ACSC issued mitigation guidance for an ongoing ClickFix campaign that is pushing Vidar Stealer through malicious PowerShell commands, increasing credential-the...

Open Happening

Legitimate-looking Chrome extension prompt-poaching campaign

Campaign
H score49 First: 25.03.2026 13:00 Last: 25.03.2026 13:00 Sources 1

About this happening: A recurring Chrome extension campaign is stealing AI conversations from users, exposing prompts, answers, and other sensitive content to attacker-controlled servers. The a...

Open Happening

Timeline

  1. 19.01.2026 11:09 2 articles · 5mo ago

    CrashFix disclosure and ModeloRAT delivery

    Initial Disclosure

    Researchers disclosed the ongoing KongTuke/CrashFix campaign, in which a malicious Google Chrome extension named NexShield – Advanced Web Guardian masquerades as an ad blocker on the Official Chrome Web Store, uses ClickFix-like lures to make victims run Windows commands, and crashes the browser through a resource-exhaustion DoS before staging ModeloRAT with finger.exe and PowerShell. The extension also transmits a unique ID to nexsnield[.]com, delays malicious behavior for 60 minutes after installation, repeats payload execution every 10 minutes, and uses domain-join checks to steer corporate machines toward a fully featured Python-based Windows RAT with Registry persistence and RC4-encrypted C2.

    Show sources
    Open in new tab