CrashFix
CrashFix is a ClickFix-style social-engineering malware delivery technique/campaign that deliberately crashes a victim’s web browser (notably Chrome) to coerce the user into manually executing attacker-supplied commands on Windows. It is delivered via malicious Chrome extensions promoted through malvertising and made to appear legitimate by redirecting victims to the official Chrome Web Store; reported lures include extensions impersonating uBlock Origin Lite and ad blockers such as “NexShield,” as well as other CrashFix/ClickFix-like extensions (e.g., Pixel Shield - Block Ads and PageGuard - Phishing Protection). After installation, the extension may delay activation (e.g., ~60 minutes) and then triggers a browser denial-of-service (e.g., infinite loops / massive runtime port connections) to force a crash. On restart, it displays a fake “CrashFix”/security warning (e.g., “stopped abnormally,” “security issues detected”) instructing the user to open the Windows Run dialog or terminal and paste/execute content; the extension pre-stages a malicious PowerShell command in the clipboard, disguised as a repair/scan command.
Post-execution, observed tradecraft includes living-off-the-land abuse of Windows finger.exe (copied/renamed to ct.exe) to retrieve obfuscated PowerShell from attacker infrastructure, which then downloads additional PowerShell (e.g., script.ps1 saved under AppData\Roaming), performs anti-analysis checks (processes/tools such as Wireshark, Process Hacker, WinDbg; VM indicators), and assesses whether the host is domain-joined. On higher-value/domain-joined systems, CrashFix has been reported to deploy a portable Python runtime (WinPython, e.g., WPy64-31401) and a Python RAT Microsoft calls “ModeloRAT” (modes.py), executed via pythonw.exe, with persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run and additional payload retrieval via Dropbox (e.g., extentions.py). Microsoft also described a related post-compromise chain that downloads a ZIP containing Python payloads and creates a scheduled task named “SoftwareProtection” to run every 5 minutes.
Attribution/associations reported in the content: Huntress attributes CrashFix activity to a tracked threat actor “KongTuke.”
High-confidence IOCs explicitly mentioned in the content include: domains www.nexsnield[.]com; IPs 69[.]67[.]173[.]30, 144.31.221[.]197, 199.217.98[.]108, 144.31.221[.]179, 158.247.252[.]178, 170.168.103[.]208; Chrome extension IDs nlogodaofdghipmbdclajkkpheneldjd and mlaonedihngoginmmlaacpihnojcoocl; sample artifacts/hashes including cpcdkmjddocikjdkbbeiaafnpdbdafmi_42974.crx (SHA-256 c46af9ae6ab0e7567573dbc950a8ffbe30ea848fac90cd15860045fe7640199c), ct.exe (SHA-256 beb0229043741a7c7bfbb4f39d00f583e37ea378d11ed3302d0a2bc30f267006), and script.ps1 (SHA-256 c76c0146407069fd4c271d6e1e03448c481f0970ddbe7042b31f552e37b55817), plus Dropbox-hosted a1.zip.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Huntress just published a report on a new ClickFix variant they’ve discovered, which they’ve dubbed CrashFix... using KongTuke’s malicious browser extension to display a fake security warning... prompting users to run a 'scan'... instructed to manually 'fix' the issue by opening the Windows Run dialog... The malicious extension silently copies a PowerShell command to the clipboard"
Techniques & procedures
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
4 techniques"...harnesses Windows tools and in-memory scripts to facilitate simultaneous delivery of various backdoors..." and "...launching the primary Python implant..."
"...silently copies a PowerShell command to the clipboard... From there, they execute the malicious command."
“display a fake security warning… prompting users to run a ‘scan’… instructed to… open the Windows Run dialog… paste… and press Enter… extension silently copies a PowerShell command to the clipboard”
“display a fake security warning… prompting users to run a ‘scan’… instructed to… open the Windows Run dialog… paste from their clipboard… The malicious extension silently copies a PowerShell command to the clipboard”
Stealth
7 techniques“obfuscated PowerShell using ROT cipher encoding… multiple layers of Base64 encoding and XOR… .NET payload adds two-layer encryption (AES-256 plus XOR)… string concatenation… junk code padding”
“copies finger.exe from System32 to the %temp% directory (renaming it to ct.exe to avoid detection)”
“downloads… saves… as script.ps1, executes it, and then deletes itself to remove evidence of the initial infection stage”
"abused a legitimate Windows binary – finger.exe – copied from System32, renamed, and executed... output... piped directly into cmd.exe... for an obfuscated PowerShell payload"
“Scans running processes for 50+ analysis tools… and VM indicators… If any are found, it exits immediately.” / “fingerprinting… distinguish a real victim from an analyst's sandbox.”
“uses Chrome's Alarms API to delay execution by 60 minutes… and… every 10 minutes thereafter”
"...harnesses Windows tools and in-memory scripts..."
Discovery
6 techniques“Checks if the machine is domain-joined or standalone (WORKGROUP)… distinguish between corporate targets and home users.”
“Checks if the machine is domain-joined… Sends… installed antivirus products… runs… VM indicators… builds a unique numeric fingerprint… C2 server uses this value to determine whether… real hardware or… analysis environment”
“Checks if the machine is domain-joined or standalone (WORKGROUP)… Domain-joined gets the VIP Treatment”
“Scans running processes for 50+ analysis tools… and VM indicators… If any are found, it exits immediately.” / “fingerprinting… distinguish a real victim from an analyst's sandbox.”
“uses Chrome's Alarms API to delay execution by 60 minutes… and… every 10 minutes thereafter”
“Sends a POST request… containing… Installed antivirus products (queried from SecurityCenter2)”
Collection
1 technique"The malicious extension silently copies a PowerShell command to the clipboard, disguised as a legitimate repair command."
Command and Control
2 techniques“copies finger.exe… renaming it to ct.exe… connect to 199.217.98[.]108 and pipes the response directly to cmd, executing whatever payload the attacker's server returns.”
“This is the Domain Generation Algorithm (DGA)… seed changes weekly… the same 10 domains are generated for an entire week… cycles through each domain until one responds”
Impact
1 technique“core malicious payload is a denial-of-service attack against the victim's own browser… iterate 1 billion times… infinite loop… exhausts system resources… eventual crashes.”
Other
2 techniquesRecent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ClickFix-style endpoint compromise technique delivered via a malicious browser extension that presents fake security warnings and coerces the user into executing a clipboard-copied PowerShell command through the Windows Run dialog, resulting in execution of attacker-controlled code.
Chrome-extension-based technique that intentionally crashes the browser (DoS) and socially engineers the user into executing attacker-provided commands; newer variants use push-notification-based C2 to selectively trigger crashes.
A ClickFix-style social engineering variant that lures users into executing a malicious payload by presenting a fake crash scenario; reported to deploy a Python RAT.
Campaign involving delivery of a primary Python implant (command execution, host reconnaissance, further payload injection) alongside additional Python scripts and a reflectively loaded DLL backdoor to enable long-term compromise, network mapping, and Active Directory targeting.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.