NexShield Malware Extension Crashes PCs to Install Malware

Foxnews

NexShield Malware Extension Crashes PCs to Install Malware

First seen 16 Feb 2026, 15:10 UTC • •29.9

Article Content

1 / 2

Browse articles

ThreatCluster •March 12, 2026 at 16:10 UTC

Security researchers have identified a malicious browser extension named NexShield that masquerades as an ad blocker for Chrome and Edge. Upon installation, it intentionally crashes the browser, misleading users into executing harmful commands that compromise their systems. Users of both Chrome and Edge are affected by this scam.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 229d ago How this analysis works

Timeline

2026-02-13

NexShield malware extension discovered

2026-02-16

Articles published detailing NexShield's tactics

More articles in this cluster (1)

Threat Graph

12 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
T1059.001 - PowerShell
T1059.003 - Windows Command Shell

Campaign (1)

CrashFix

Malware (2)

ClickFix
ModeloRAT

Affected Platform (3)

Chrome Web Store
Microsoft Edge
Windows

Tool (3)

Google Chrome
Command Prompt
PowerShell

Relationships

CrashFix uses ClickFix
CrashFix uses ModeloRAT
Malware targets Chrome Web Store
Malware targets Microsoft Edge
Malware targets Windows
T1059.001 - PowerShell targets Chrome Web Store
T1059.001 - PowerShell targets Microsoft Edge
T1059.001 - PowerShell targets Windows
T1059.003 - Windows Command Shell targets Chrome Web Store
T1059.003 - Windows Command Shell targets Microsoft Edge
T1059.003 - Windows Command Shell targets Windows
CrashFix related to Google Chrome
CrashFix related to Command Prompt
CrashFix related to PowerShell

Following this threat?

Track ClickFix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Active Exploitation of Siemens Software Center Vulnerability in ClickFix Campaign Siemens has confirmed that a DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center is actively being exploited in malware attacks. The vulnerability allows attackers to execute malicious code by placing a specially crafted DLL in a directory searched by the application. Siemens first disclosed…

Cybercriminals Exploit ChatGPT Custom GPTs for ClickFix RAT Attacks A new ClickFix campaign has been discovered that exploits ChatGPT Custom GPTs to impersonate legitimate products, luring users into executing malicious code. Cybersecurity firm Huntress reported that at least 40 users have been infected, with two confirmed incidents linked to Custom GPT instances. The attackers…