Fake extension crashes browsers to trick users into infecting themselves

According to Malwarebytes, researchers have uncovered a new variant of the ClickFix‑style trick called CrashFix, masquerading in the Chrome Web Store as “NexShield – Advanced Web Protection.” The extension phones home to nexsnield[.]com and uses Chrome’s Alarms API to wait 60 minutes before launching its malicious behaviour, a delay designed to blunt immediate suspicion.

After the pause, it initiates a denial‑of‑service loop that exhausts the device’s resources by repeatedly opening chrome[.]runtime port connections, eventually making the browser unresponsive and crash. When the browser restarts, users are shown a pop‑up claiming abnormal termination and are guided to paste a command via Win+R, Ctrl+V and Enter, which, if followed, executes a malicious PowerShell or cmd command copied from the clipboard and infects the user’s machine.

Fingerprinting checks may then decide the payload: on domain‑joined devices the malware payload is a Python remote access trojan dubbed ModeloRAT, while non‑domain machines return a TEST PAYLOAD!!!!, suggesting ongoing development.