Loading story…
Recent threat activity has highlighted two distinct user-targeted campaigns: mass spam sent from legitimate Zendesk domains and a browser-crash social-engineering chain delivering malware. Multiple users reported receiving hundreds of emails originating from real companies’ Zendesk helpdesk instances (including brands such as Live Nation, Capcom, and Tinder), with many messages bypassing common spam filters; the lures included bogus legal notices intended to drive credential theft, initial access, or payment. Zendesk has previously warned about attackers abusing its platform for relay spam, and reporting indicated the current wave was not tied to a Zendesk breach or a specific software vulnerability.
Separately, Huntress reported a more sophisticated ClickFix-style operation dubbed “CrashFix” that uses a malicious Chrome Web Store extension (NexShield, masquerading as uBlock Origin Lite) to intentionally crash the victim’s browser and then present a fake “fix” prompt that advances the infection chain. The campaign was attributed to KongTuke and culminates in delivery of a Python-based RAT (ModeloRAT), with domain-joined systems receiving specially tailored backdoor payloads—raising risk for enterprise environments where browser-based workflows are prevalent. Other items in the set were general-interest content (enterprise browser product comparison, a cyberattacks timeline roundup, and an acquisition announcement) and did not provide additional, specific reporting on these two active campaigns.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Alongside its report, Huntress released indicators of compromise and advised defenders to monitor for suspicious Windows utility use, malicious browser extensions, Registry Run-key persistence, and Python spawning hidden PowerShell.
In the CrashFix campaign, users searching for an ad blocker were lured via malicious ads to install "NexShield," a Chrome Web Store extension posing as uBlock Origin Lite. After forcing a browser crash, the extension led victims to execute a PowerShell command that profiled the host and delivered the newly seen Python-based ModeloRAT to domain-joined Windows systems.
Huntress Labs reported a new "CrashFix" variant of the ClickFix scam attributed to the threat actor it tracks as KongTuke. The campaign used a fake Chrome extension and browser-crash ruse to trick victims into running a malicious repair command.
As reports of the spam campaign spread, Zendesk's security team was said to be investigating whether the activity stemmed from the previously documented relay-spam issue or a different abuse path, such as help-desk workflow manipulation or configuration weaknesses.
ElevenLabs publicly apologized for a mass spam attack affecting its email ticketing system and said it was working with Zendesk to resolve the issue. The statement linked a named victim organization to the broader Zendesk abuse activity.
By January 2026, multiple users reported a wave of spam emails sent from Zendesk domains tied to real companies, with themes such as bogus lawsuits and legal or government notices. The messages often bypassed spam filters and appeared aimed at credential theft, initial access, or fraud.
Before the January 2026 spam wave, Zendesk published an advisory warning that attackers could send spam through Zendesk using relay-spam techniques involving misconfigured email servers and recommended mitigations for customers.
In November 2025, ReliaQuest reported that actors linked to "Scattered Lapsus$ Hunters" may have been preparing a campaign against Zendesk environments using typosquatted and phishing login pages to harvest credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **malicious browser-extension** campaigns abusing official extension stores and search-driven lures to compromise enterprise users. Huntress documented a Chrome Web Store extension, **“NexShield – Advanced Web Guardian”** (a near-clone of *uBlock Origin Lite*), distributed via search/advertising redirection and designed to intentionally “freeze” the browser and present a fake **CrashFix** security prompt that instructs users to paste and run commands via `Win + R`; this social-engineering step results in installation of a previously undocumented Windows RAT dubbed **ModeloRAT** on domain-joined endpoints. Reporting also tied the delivery to a traffic distribution system (**KongTuke**, also tracked as **404 TDS/TAG-124** and other aliases) used to profile victims and route them to payload delivery infrastructure that has been leveraged by other criminal operations, including ransomware affiliates. Separately, Socket.dev analysis described **five coordinated Chrome extensions** targeting enterprise SaaS platforms (**Workday, NetSuite, SuccessFactors**) to enable account takeover via **session hijacking**, including continuous token theft and **bidirectional cookie injection** that can bypass MFA by replaying stolen session cookies. In parallel, Malwarebytes reported “sleeper” extension campaigns attributed to **DarkSpectre** (including **GhostPoster** and **ShadyPanda**) that turned previously benign extensions malicious after updates and used **steganography** (JavaScript hidden in extension images) to evade detection across **Edge, Chrome, and Firefox**, with large download counts and long dwell time. A separate Nextron Systems report described a related distribution pattern—malicious “free converter” apps promoted via **malicious Google ads** and made to look legitimate with **code-signing certificates**—highlighting the broader trend of search/advertising-driven initial access leading to persistent RAT deployment, though it is not the same extension-specific incident as the NexShield/CrashFix chain.
Jun 29, 2026
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026
Security researchers reported several **social-engineering campaigns** that abuse trusted platforms to increase credibility and bypass controls. One campaign targeted wedding planners and related vendors by hijacking trust in *Microsoft Teams*: attackers used compromised legitimate email threads and impersonated legal professionals (e.g., `czimmerman@craigzlaw[.]com`) to lure victims into clicking a fake Teams meeting link that ultimately redirected to `ussh[.]life/connect/teamsfinal/9/windows`, a site masquerading as a Teams download page. Victims were prompted to download Windows executables consistent with **information-stealer** behavior (credential/browser/session-token theft and C2 exfiltration), enabling follow-on account takeover and additional phishing. Separately, a report highlighted **DKIM replay**-style phishing in which criminals abuse legitimate notification/invoice workflows from **PayPal, Apple, and DocuSign** to generate cryptographically signed emails that pass DKIM/DMARC checks; attackers place scam content (often a fake support phone number and urgency) into user-controlled fields, send the message to themselves to obtain a “clean” vendor-signed email, then forward it to targets. Another campaign used **Bing search ads** to funnel users through a newly registered domain (`highswit[.]space`) to scam pages hosted on **Microsoft Azure Blob Storage** (consistent path pattern including `werrx01USAHTML/index.html` and a phone-number parameter), presenting fake Microsoft security warnings and directing victims to call numbers such as `1-866-520-2041` and `1-833-445-4045`; Netskope observed impact across dozens of US organizations.
Jun 29, 2026