CrashFix – Hackers Using Malicious Extensions to Display Fake Browser Warnings

Cybersecurity researchers uncovered the CrashFix campaign, where a malicious Chrome extension (NexShield) intentionally crashes browsers by exhausting runtime ports, then prompts victims to run a clipboard PowerShell command that installs additional malware (including ModeloRAT); the operation is attributed to KongTuke and preferentially targets corporate, domain-joined machines.