Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’

A fresh variant of the ClickFix attack uses a malicious Chrome extension to display a security warning and lure victims into executing commands to install malware, according to Huntress. Dubbed CrashFix, the campaign begins with the NexShield extension, which impersonates the legitimate uBlock Origin Lite ad blocker. The attack silently copies malicious PowerShell commands to the clipboard and uses a DoS routine to exhaust the victim’s browser, ultimately causing a crash and prompting the fake fix.

The malware operator behind the campaign, dubbed KongTuke, is active since at least early 2025 and targets domain-joined corporate environments. The core function iterates one billion times to create a chrome[.]runtime port connection, then repeats in an infinite loop, with a 60-minute delay before triggering and subsequent 10-minute intervals, only against users the extension has assigned a C&C ID.

The infection chain culminates in ModeloRAT, a Python-based remote access trojan, installed on domain-joined systems to enable reconnaissance, persistence and command execution.