'CrashFix' Scam Crashes Browsers, Delivers Malware

A new variant of the ClickFix-inspired scam, dubbed CrashFix, uses a NexShield malicious browser extension to crash the victim’s browser and then present a fraudulent repair message. According to Huntress Labs, the campaign targets both home users and corporate networks, with domain-joined machines receiving specially crafted backdoor malware called ModeloRAT.

Huntress attributes the activity to the threat actor KongTuke, a group they have tracked since early 2025, noting a step up in sophistication and a focus on enterprise targets. The ModeloRAT portion collects system information, checks for analysis tools and virtual machine indicators, and uses RC4 encryption for C2 communications, while it attempts to hide payloads behind names mimicking legitimate apps such as Spotify and Discord. The infection chain begins when the victim restarts a crashed browser and follows a PowerShell‑based repair command to contact the attacker’s C2 server.