CrashFix Chrome Extension Delivers ModeloRAT Using ClickFix-Style Browser Crash Lures

Cybersecurity researchers have disclosed a campaign, dubbed KongTuke, that used a malicious Chrome extension masquerading as an ad blocker to crash the browser and deliver a remote access trojan dubbed ModeloRAT through ClickFix-style lures. The extension, “NexShield – Advanced Web Guardian” (ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi), was downloaded at least 5,000 times before being taken down and is described as a near-identical clone of a legitimate ad blocker add-on.

According to Huntress, the attack chain fake-screams a security warning and then instructs victims to run a Windows command, which triggers a DoS-style crash by spawning a runaway loop that opens trillions of runtime port connections. The operation can transmit a unique victim ID to an attacker-controlled server, enabling tracking, and deploys a delayed execution that triggers 60 minutes after install and again every 10 minutes thereafter.

When the target is domain-joined, the campaign culminates with ModeloRAT, a Python-based Windows RAT using RC4 for C2, with persistence via the Registry and multi-stage payloads; the beaconing is configured to 300 seconds by default, but can rapidly switch to 150 milliseconds in active mode, with back-off to 900 seconds after repeated failures.

This campaign highlights evolving social engineering that impersonates open-source projects to sustain infection, with the broader ecosystem including various affiliates and infrastructure observed by Recorded Future in April 2025.