---
title: New 'CrashFix' Scam Intentionally Crashes Browsers to Deliver Malware
description: "Uncover the \"CrashFix\" scam: a malicious Chrome extension crashes browsers, leading to fake security fixes and malware threats."
canonical_url: https://codekeeper.co/ticker/crashfix-scam-malicious-chrome-extension
---

# New 'CrashFix' Scam Intentionally Crashes Browsers to Deliver Malware

Uncover the "CrashFix" scam: a malicious Chrome extension crashes browsers, leading to fake security fixes and malware threats.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jan 21, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals are using a sophisticated new attack called "CrashFix" that deliberately crashes victims' browsers before offering a fake solution. The scam starts with a malicious Chrome extension called NexShield, disguised as the popular uBlock Origin Lite ad blocker. Once installed, the extension waits an hour then floods the browser with connection requests, causing it to crash. When users try to restart, they see a fake security warning instructing them to run a "repair" command that's actually malware. Huntress Labs discovered corporate networks receive ModeloRAT, a sophisticated backdoor, while home users get test payloads. The threat actor "KongTuke" clearly prioritizes business targets over individual users. **Source:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/crashfix-scam-crashes-browsers-delivers-malware)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcrashfix-scam-malicious-chrome-extension%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks New Citrix NetScaler Zero-Day Hits Already-Patched Systems Oct 7, 2026](https://codekeeper.co/ticker/citrix-netscaler-zero-day-exploit-cve-2026-88779)

[North Korean Hackers Poison Open Source Packages in Ongoing Supply Chain Attack Aug 12, 2026](https://codekeeper.co/ticker/north-korean-hackers-target-open-source-software)

[Software security Attackers Are Exploiting a Maximum-Severity Cisco ISE Flaw Sep 21, 2026](https://codekeeper.co/ticker/cisco-patches-critical-ise-vulnerability)

[FortiBleed Campaign Linked to Inc and Lynx Ransomware Gangs Aug 12, 2026](https://codekeeper.co/ticker/fortibleed-attack-ransomware-nextcloud-exploit)