Loading malware…
CrashFix is a ClickFix-style social-engineering campaign attributed by Huntress to the KongTuke threat actor. It uses malicious Chrome ad-blocking extensions, including extensions impersonating uBlock Origin Lite or presented as NexShield, which have been promoted through malicious advertisements and installed from the Chrome Web Store. The extensions retain apparent ad-blocking functionality but delay their malicious actions, then deliberately exhaust browser resources and crash Chrome. On restart, victims are shown a fraudulent security or recovery warning and instructed to paste and run a purported repair command through the Windows Run dialog or terminal. The extension covertly places a malicious PowerShell command on the clipboard, relying on victim-driven execution rather than exploitation.
The execution chain abuses the Windows Finger client and obfuscated PowerShell to retrieve additional stages. It performs anti-analysis and environment checks and selectively deploys more capable tooling to domain-joined enterprise systems. Observed payloads include a portable Python runtime and ModeloRAT, a Python-based remote-access trojan that communicates with attacker-controlled infrastructure, executes commands and additional payloads, and establishes Windows Registry Run-key persistence. Related activity has also used scheduled-task persistence. CrashFix primarily targets Windows systems and appears designed to prioritize higher-value corporate environments while using delayed execution, renamed legitimate utilities, scripting, and living-off-the-land techniques to reduce detection.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Huntress just published a report on a new ClickFix variant they’ve discovered, which they’ve dubbed CrashFix... using KongTuke’s malicious browser extension to display a fake security warning... prompting users to run a 'scan'... instructed to manually 'fix' the issue by opening the Windows Run dialog... The malicious extension silently copies a PowerShell command to the clipboard"
21 distinct techniques documented for this family, organized by ATT&CK tactic.
"...harnesses Windows tools and in-memory scripts to facilitate simultaneous delivery of various backdoors..." and "...launching the primary Python implant..."
"...silently copies a PowerShell command to the clipboard... From there, they execute the malicious command."
“display a fake security warning… prompting users to run a ‘scan’… instructed to… open the Windows Run dialog… paste… and press Enter… extension silently copies a PowerShell command to the clipboard”
“display a fake security warning… prompting users to run a ‘scan’… instructed to… open the Windows Run dialog… paste from their clipboard… The malicious extension silently copies a PowerShell command to the clipboard”
“A fake ad blocker known as CrashFix, points targets to the official Chrome Web Store, and even waits an hour after installation before displaying its first bogus alert.”
“obfuscated PowerShell using ROT cipher encoding… multiple layers of Base64 encoding and XOR… .NET payload adds two-layer encryption (AES-256 plus XOR)… string concatenation… junk code padding”
“copies finger.exe from System32 to the %temp% directory (renaming it to ct.exe to avoid detection)”
“downloads… saves… as script.ps1, executes it, and then deletes itself to remove evidence of the initial infection stage”
"abused a legitimate Windows binary – finger.exe – copied from System32, renamed, and executed... output... piped directly into cmd.exe... for an obfuscated PowerShell payload"
“Scans running processes for 50+ analysis tools… and VM indicators… If any are found, it exits immediately.” / “fingerprinting… distinguish a real victim from an analyst's sandbox.”
“uses Chrome's Alarms API to delay execution by 60 minutes… and… every 10 minutes thereafter”
"...harnesses Windows tools and in-memory scripts..."
“exits immediately [if analysis tools/VM indicators found]… closes processes… All subprocess calls use hidden window execution with CREATE_NO_WINDOW… disables certificate verification (CERT_NONE)”
“Checks if the machine is domain-joined or standalone (WORKGROUP)… distinguish between corporate targets and home users.”
“Checks if the machine is domain-joined… Sends… installed antivirus products… runs… VM indicators… builds a unique numeric fingerprint… C2 server uses this value to determine whether… real hardware or… analysis environment”
“Checks if the machine is domain-joined or standalone (WORKGROUP)… Domain-joined gets the VIP Treatment”
“Scans running processes for 50+ analysis tools… and VM indicators… If any are found, it exits immediately.” / “fingerprinting… distinguish a real victim from an analyst's sandbox.”
“uses Chrome's Alarms API to delay execution by 60 minutes… and… every 10 minutes thereafter”
“Sends a POST request… containing… Installed antivirus products (queried from SecurityCenter2)”
"The malicious extension silently copies a PowerShell command to the clipboard, disguised as a legitimate repair command."
“copies finger.exe… renaming it to ct.exe… connect to 199.217.98[.]108 and pipes the response directly to cmd, executing whatever payload the attacker's server returns.”
“This is the Domain Generation Algorithm (DGA)… seed changes weekly… the same 10 domains are generated for an entire week… cycles through each domain until one responds”
“core malicious payload is a denial-of-service attack against the victim's own browser… iterate 1 billion times… infinite loop… exhausts system resources… eventual crashes.”
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.