New 'CrashFix' Scam Intentionally Crashes Browsers to Deliver Malware

Uncover the "CrashFix" scam: a malicious Chrome extension crashes browsers, leading to fake security fixes and malware threats.

By Content Team

Jan 21, 2026

ON THIS PAGE

Cybercriminals are using a sophisticated new attack called "CrashFix" that deliberately crashes victims' browsers before offering a fake solution. The scam starts with a malicious Chrome extension called NexShield, disguised as the popular uBlock Origin Lite ad blocker.

Once installed, the extension waits an hour then floods the browser with connection requests, causing it to crash. When users try to restart, they see a fake security warning instructing them to run a "repair" command that's actually malware.

Huntress Labs discovered corporate networks receive ModeloRAT, a sophisticated backdoor, while home users get test payloads. The threat actor "KongTuke" clearly prioritizes business targets over individual users.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?