'CrashFix' Scam Crashes Browsers, Delivers Malware

Huntress researchers uncovered a sophisticated campaign dubbed "CrashFix" in which a malicious Chrome extension (NexShield) masquerading as a legitimate ad blocker intentionally crashes victims' browsers and prompts a fake repair that executes a PowerShell payload contacting a C2. The actor, attributed to 'KongTuke', prioritizes domain-joined corporate systems where it deploys ModeloRAT — a Python-based remote access Trojan that gathers system and network reconnaissance, uses RC4-encrypted C2, maintains persistence via Windows Registry modifications, and employs anti-analysis techniques; Huntress published IOCs and recommends monitoring for suspicious extensions, unusual Run key entries, and hidden PowerShell processes.