Dissecting CrashFix: KongTuke's New Toy

What it is

A Huntress report (analyst Tanner Filip, January 2026) on a KongTuke campaign — an actor Huntress has tracked since early 2025. Three new components: NexShield, a malicious Chrome extension that clones the legitimate uBlock Origin Lite ad blocker; CrashFix, a ClickFix-style social-engineering variant that deliberately crashes the browser to bait users into pasting a PowerShell command; and ModeloRAT, a previously undocumented Python RAT reserved for domain-joined hosts.

How it works

The victim searches for a Chrome ad blocker and clicks a malicious ad leading to a real Chrome Web Store listing (chromewebstore.google.com/detail/nexshield-…/cpcdkmjddocikjdkbbeiaafnpdbdafmi), which lends legitimacy. NexShield is a near-identical copy of uBlock Origin Lite — the release compared was labeled 2025.1116.1842 vs. the legitimate 2025.1116.1841, differing mainly in a background.js that is ~14% (3,276 bytes) larger. That file adds C2 tracking to the typosquatted domain nexsnield[.]com (note the "n"), sending install/update/uninstall beacons with a per-victim UUID plus version info.

Post-install, a fake "browser stopped abnormally" pop-up prompts a "scan," then a "Security issues detected" alert instructs the user to open Run (Win+R), paste (Ctrl+V), and press Enter. The extension silently places a PowerShell command on the clipboard disguised as a repair command (displayed as edge.exe -fix-browser -hash=…). Executing it delivers the payload.

flowchart TD
  A[Search for ad blocker] --> B[Malicious ad → Chrome Web Store]
  B --> C[Install NexShield]
  C --> D{Host domain-joined?}
  D -->|Yes| E[ModeloRAT — AD/lateral movement]
  D -->|No| F["TEST PAYLOAD!!!!" — chain still in testing]
  C --> G[Fake crash pop-up → CrashFix]
  G --> H[User pastes PowerShell via Run dialog]

Preconditions / Affected

Chrome users who install the NexShield extension and then manually follow the paste-and-run steps. The full ModeloRAT infection chain fires only on domain-joined machines — KongTuke is explicitly targeting corporate/AD environments. Standalone home hosts get a separate chain that appears unfinished (C2 returned TEST PAYLOAD!!!!).

What to do

Detections and indicators the page provides:

• Extension ID cpcdkmjddocikjdkbbeiaafnpdbdafmi; developer email [email protected].
• C2 / beacon domain nexsnield[.]com (typosquat of the nexshield name), with paths /install, /update, and an uninstall URL, all carrying a UUID and version.
• Watch for clipboard-pasted PowerShell launched via the Run dialog (classic ClickFix behavior) and browser crashes tied to a "fix" prompt.

Caveats

The version comparison covers the NexShield build live on January 14; the non-domain infection chain was still in testing at analysis time, so its final payload is unknown. The fetched text cuts off at the uninstall-tracking section, so later technical detail (e.g., full ModeloRAT analysis and the complete IOC list) is not captured here.