CrashFix Campaign Delivers ModeloRAT via Malicious Chrome Extension

CrashFix Campaign Delivers ModeloRAT via Malicious Chrome Extension

First seen 21 Jan 2026, 06:39 UTC •BleepingcomputerCsoonlineScmagazine •86% similarity •33.6

Article Content

Browse articles
ThreatCluster

A malicious campaign named CrashFix has been identified, utilizing a fake ad-blocking browser extension called NexShield to crash users' browsers. This tactic is employed to facilitate ClickFix attacks, delivering a new Python-based remote access tool known as ModeloRAT, primarily targeting corporate environments. The NexShield extension has since been removed from the Chrome Web Store.

ThreatCluster AI How this analysis works

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

KongTuke ClickFix Interlock RAT ModeloRAT ModelRAT SocGholish Contagious Interview Operation CrashFix Chrome Web Store Edge Windows